Linux Foundation' Linux workstation security checklist
From the reg: http://www.theregister.co.uk/2015/08/31/harden_like_linux_foundation/ with journo title: Linux Foundation releases PARANOID internal infosec guide
The document appears to be: https://github.com/lfit/itpol/blob/master/linux-workstation-security.md Linux workstation security checklist Troll-friendly appears this claim: UEFI boot mode is used (not legacy BIOS) (CRITICAL) UEFI and SecureBoot (ask RMS ;-) )
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, Upon reading this post "Linux Foundation' Linux workstation security checklist" a little thing went "bing!" in my brain and I remembered something. I went and looked it up and it was still there. Here it is, hopefully relevant / helpful to the discussion (what I found helpful as the basics on Ubuntu / Linux security): https://ubuntuforums.org/showthread.php?t=510812 Georgi Guninski:
From the reg: http://www.theregister.co.uk/2015/08/31/harden_like_linux_foundation/
with journo title: Linux Foundation releases PARANOID internal infosec
guide
The document appears to be: https://github.com/lfit/itpol/blob/master/linux-workstation-security.m d
Linux workstation security checklist
Troll-friendly appears this claim: UEFI boot mode is used (not legacy BIOS) (CRITICAL) UEFI and SecureBoot
(ask RMS ;-) )
- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJV5JIqAAoJEGxwq/inSG8CLXIH/0IL7WRrsl3ionQDlbj6iE8K +4xPZQuWWjkPdgLWk/wyW0hsO8PQasiyhP9xxqxlSVwbeswC0CfJT2tqbAO2GYga 4UtGVi69kSuQYZ9h7WD6ai29XdLid1vBzY9lIrT5RSFhB3F647TQeEej4RoYJzcn ZRQ+ItX3ooh9s+rhKKGIQv2laU0PBfK+o6pwbuNiIQSqVEAjTgMdwhEBDxlBizQn bsX0XZmGLtSr7iLYtRIHjaCIzzDAgGVtWci2VQypy6ejoieDE/D3vDDVKAadgQ2N CBJ1aor+FuMzJubvAyh4JrW5YeZSMcma5EgFd55vi5TQFSweId6kLSf1dP7Uu58= =RZ73 -----END PGP SIGNATURE-----
On 08/31/2015 04:13 AM, Georgi Guninski wrote:
The document appears to be: https://github.com/lfit/itpol/blob/master/linux-workstation-security.md Linux workstation security checklist
Since the Linux Foundation advise is recommending UEFI and Secure Boot and TPMs, I think they should also recommend running Intel CHIPSEC -- directly or via LUV-live -- for firmware vulnerability analysis, at least on the Intel systems (AMD has no CHIPSEC port). If system was designed vulnerable by vendor, there's little point in bothering with Secure Boot or any OS-level hardening.... https://01.org/linux-uefi-validation/downloads/luv-live-image https://github.com/chipsec/chipsec Guidance should probably enable Verified Boot when running Chrome, perhaps the Verified U-Boot and other secure coreboot/U-Boot implementations. The advise should also mention something about each distro's Secure Boot varies in strength, some allow unsigned kernel drivers to be loaded even if Secure Boot is enabled. http://firmwaresecurity.com/2015/07/17/secure-boot-strength-varies-by-linux-... It should mention virtual firmware security (inside VirtualBox, QEMU, etc), especially after last BlackHat talk: http://firmwaresecurity.com/2015/08/08/689/ There's more to do, taking snapshots of rom, scanning for changes, tracking vendor firmware updates, ensuring system has fresh firmware bits, etc. But it's a nice start.
Troll-friendly appears this claim: UEFI boot mode is used (not legacy BIOS) (CRITICAL) UEFI and SecureBoot
(ask RMS ;-) )
AFAIK, RMS uses an IBM Thinkpad retrofitted with LibreBoot (presumably using SeaBIOS BIOS clone). https://stallman.org/stallman-computing.html I don't think RMS is responsible for LF's IT security policies. :-) If someone has one of these old Thinkpads boxes (sold by "Ministry of Freedom" (formerly trading as Gluglug), please try to run CHIPSEC on it; if it runs, run chipsec_main.py to see if it passes the security tess. I don't expect CHIPSEC will recognize the ancient Intel chipset used by the old IBM Thinkpad. It'd probably take someone to update CHIPSEC to add system data for this old chipsec, in order to make it work. Perhaps Ministry of Freedom has a vested interest? :-) Potential insecurely-built IBM system firmware security aside, I don't think Libreboot nor SeaBIOS offers much in terms of security to stop attackers, as well. U-Boot and coreboot both have PKI-enabled boot flavors that're vaguely like UEFI's Secure Boot, which Ministry of Freedom could be using, to help secure their modern customers.
On 8/31/15, Blibbet <blibbet@gmail.com> wrote:
... If someone has one of these old Thinkpads boxes (sold by "Ministry of Freedom" (formerly trading as Gluglug), please try to run CHIPSEC on it;
does not run; not needed.
Potential insecurely-built IBM system firmware security aside, I don't think Libreboot nor SeaBIOS offers much in terms of security to stop attackers, as well.
building your own BIOS images, signing your own bootstraps, is "not offer much"? you're wrong and these are incredibly useful security measures. of course by no means sufficient by themselves, and you must always keep your laptops/devices safe with you, lest they be implanted by trivial means with physical access. best regards,
On Mon, Aug 31, 2015 at 07:33:24PM -0700, coderman wrote:
building your own BIOS images, signing your own bootstraps, is "not offer much"?
you're wrong and these are incredibly useful security measures.
They protect against trojanized (off the shelf) BIOS. If an adversary has sufficient supply of application and root sploits, how much they will protect you? Instead of rootkit they will root you every boot IMHO.
On 9/1/15, Georgi Guninski <guninski@guninski.com> wrote:
... They protect against trojanized (off the shelf) BIOS.
prevents trojan / arb exec from persistence via BIOS. prevents surreptitious FDE keylogger via BIOS hooks. yes, also off the shelf attacks. which is nearly all of them. :) [ see also HackingTeam dump, and research examples ]
If an adversary has sufficient supply of application and root sploits, how much they will protect you?
separate question; see also defense in depth. however, a robust bespoke BIOS beats otherwise cascade catastrophe.
Instead of rootkit they will root you every boot IMHO.
this also has a different visibility, as executing in priv. or user context & addr space. also why "throw away" VMs per Qubes or Live OS images a useful technique to avoid attempted persistence via weird machines gone rogue... best regards,
On 08/31/2015 07:33 PM, coderman wrote:
On 8/31/15, Blibbet <blibbet@gmail.com> wrote:
... Potential insecurely-built IBM system firmware security aside, I don't think Libreboot nor SeaBIOS offers much in terms of security to stop attackers, as well.
building your own BIOS images, signing your own bootstraps, is "not offer much"?
you're wrong and these are incredibly useful security measures.
of course by no means sufficient by themselves, and you must always keep your laptops/devices safe with you, lest they be implanted by trivial means with physical access.
I merely meant that BIOS didn't offer new security tech, that newer firmware tech does. My point was that Verified coreboot is stronger than Libreboot, and Ministry of Freedom could be using stronger open source tech in their product than they currently do. Eg, coreboot has Verified Boot mode, which is roughly like UEFI's Secure Boot, and can help protect the a blob-free system more than just Libreboot. Yes, building your own code is great, if you're able to do so. Building a stock BIOS with no security is great, but a stock BIOS won't stop attackers. Users should not have to rebuild their refurbished firmware to make it better, the vendor should offer that. Fear of blobs is one thing, fear of firmware attacks are another. Blobs are a great place for malware to hide, so there is an obvious relationship, but some freedom/privacy-loving users often seem to only focus on getting rid of blobs, and not pay much attention to the security of their firmware. My concern about Purism is that they'll disable enough security features to reduce the amount of FSP blobs such that the system is more attractive to attackers than normal PCs. Having an ancient laptop may help. Attackers may not be able to use CHIPSEC's HAL, that's the positive side of not being able to use CHIPSEC to test your defenses. :-) But there are alternatives to CHIPSEC's HAL, and they're less strict about chipsec support, and will likely work on old Thinkpads. Recently someone ported a modern ARM-based Chromebook (ASUS C201, Veyron Speedy) to use Libreboot, w/o blobs. That's another alternative to old x86 systems, with different attacks. I'm not sure what's safer, ARM or x86 these days. x86 BIOS/UEFI attackers are well-documented by researchers, but ARM-based ones are less so, AFAICT. I'm unclear what's safer from attackers, an old x86, or a modern ARM or AMD system. http://firmwaresecurity.com/2015/08/13/libreboot-ported-to-modern-arm-chrome... Blob-free and secure, that's my goal. BIOS -- even Libreboot's SeaBIOS -- is not secure. Thanks, Lee RSS: http://firmwaresecurity.com/feed
On 9/1/15, Blibbet <blibbet@gmail.com> wrote:
... I merely meant that BIOS didn't offer new security tech, that newer firmware tech does. My point was that Verified coreboot is stronger than Libreboot, and Ministry of Freedom could be using stronger open source tech in their product than they currently do. Eg, coreboot has Verified Boot mode, which is roughly like UEFI's Secure Boot, and can help protect the a blob-free system more than just Libreboot.
thank you for the clarification :)
... Users should not have to rebuild their refurbished firmware to make it better, the vendor should offer that.
you've got my vote ;)
Recently someone ported a modern ARM-based Chromebook (ASUS C201, Veyron Speedy) to use Libreboot, w/o blobs. That's another alternative to old x86 systems, with different attacks. I'm not sure what's safer, ARM or x86 these days. x86 BIOS/UEFI attackers are well-documented by researchers, but ARM-based ones are less so, AFAICT. I'm unclear what's safer from attackers, an old x86, or a modern ARM or AMD system. http://firmwaresecurity.com/2015/08/13/libreboot-ported-to-modern-arm-chrome...
it appears nothing is safe, and the effort is trivial to modest. #infosec
Blob-free and secure, that's my goal. BIOS -- even Libreboot's SeaBIOS -- is not secure.
this reminds me of the open hardware processor designs; yes - it is open! but, it lacks modern security features to assist operating system and application developers securing their systems... fun problems :) best regards,
On 9/1/15, Georgi Guninski <guninski@guninski.com> wrote:
it appears nothing is safe, and the effort is trivial to modest. #infosec
That was my point.
what's funny is this leads to security advantage through obscurity, where the bespoke solutions break off-the-shelf exploitation techniques. this delay between failed attempt and success, or simply failed attempt and plan B, used to provide early warning and feedback. what a world we live in! best regards,
what's funny is this leads to security advantage through obscurity, where the bespoke solutions break off-the-shelf exploitation techniques.
[I'm behind; this may be a duplicate] DARPA is actively looking at obfuscation https://www.fbo.gov/index?s=opportunity&mode=form&id=a303af332a90b1e84fdb91d7dd382396&tab=core&_cview=0 Which leads me to ask the general question, what does one do when something you might soon depend upon can simply never be analyzed? We can oh so easily return to a world of sorcerers, alchemy, and faith in powers in proportion to their mystery. --dan
On Tue, 15 Sep 2015 22:15:10 -0400 dan@geer.org wrote:
what's funny is this leads to security advantage through obscurity, where the bespoke solutions break off-the-shelf exploitation techniques.
[I'm behind; this may be a duplicate]
DARPA is actively looking at obfuscation https://www.fbo.gov/index?s=opportunity&mode=form&id=a303af332a90b1e84fdb91d7dd382396&tab=core&_cview=0
Dr. Michael Hsieh, SafeWare@darpa.mil that's a good address to send so called child porn
Which leads me to ask the general question, what does one do when something you might soon depend upon can simply never be analyzed?
We can oh so easily return to a world of sorcerers, alchemy, and faith in powers in proportion to their mystery.
--dan
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/15/2015 10:27 PM, Juan wrote:
On Tue, 15 Sep 2015 22:15:10 -0400 dan@geer.org wrote:
what's funny is this leads to security advantage through obscurity, where the bespoke solutions break off-the-shelf exploitation techniques.
[I'm behind; this may be a duplicate]
DARPA is actively looking at obfuscation https://www.fbo.gov/index?s=opportunity&mode=form&id=a303af332a90 b1e84fdb91d7dd382396&tab=core&_cview=0
Dr. Michael Hsieh, SafeWare@darpa.mil
that's a good address to send so called child porn
And other waterhole attacks of various types... any ole thing that's likely to bet bookmarked and passed around the office or - horror of horrors - taken home. :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJV+gFGAAoJEDZ0Gg87KR0LMR8QANd8M+naBz+oWlyeWQ4PNMQ0 3U+0Qu/0G9zqJldEiYUtIckvgHhHeEcuIJdQ+ouMJTRkpUek2YHA6e6+Qwts+XMU ZVIx1wa2mFOCXdQ9VbzjQfcMMsYjw1xMjlSoaL3zFr1P0ABB9aOSyswz7jq4trKg o2BpDuZb5inxVIzfl2HILNcOifG8iOX+6iDcdDdE8NeIoAQiidcxTcIKwP/wIXIB Fb5X5eigztEj6+Bhqup1naZRyU3+AqEyZSHJeVvtDBMiF7pOmfSAvvJcYSyy0zeQ aYYck9x8vVzTdSzFj7yHItRwsaDBl8KIvGOpR5JajS4ydKlKA4ifUaBE5QfZFMN2 4zqM75Iqms1RL5fnHppcytXfiIFRdRgJMaOgn3G+dcrLUb2fFuCKkMSVJMWoZRZd oTIu3bOpfXaUyfHy2j3w08LLOzZBJ2rmzhc33bv8buZY1oMbGTy3D6164QVScwnu Uw5yi9zdfPck2B2ivBxYRwhxfxzdVKw5ubk5LXPzbk1Jpd1g9o49IbcdELOjPLKc 3FHr99tEB/xJ6fy8crT2jTFOUThYZR6wayCuqkX2/mYO1NXlUd3nJLS9CxkYbOMb gDeuNtCLCv09OAYyOfitHKYN9BOGPWbehteojcDsteL9dE7ZGu9R9F1tUU9a0qOk gIxS+htvjPWwq+0ydl1s =4vED -----END PGP SIGNATURE-----
On 09/01/2015 08:43 AM, Blibbet wrote:
On 8/31/15, Blibbet <blibbet@gmail.com> wrote:
... Potential insecurely-built IBM system firmware security aside, I don't think Libreboot nor SeaBIOS offers much in terms of security to stop attackers, as well. ... Having an ancient laptop may help. Attackers may not be able to use CHIPSEC's HAL, that's the positive side of not being able to use CHIPSEC to test your defenses. :-) But there are alternatives to CHIPSEC's HAL, and they're less strict about chipsec support, and will likely work on
On 08/31/2015 07:33 PM, coderman wrote: old Thinkpads.
Re: security of the IBM Thinkpads refurbished by the Ministry of Freedom, it might be useful to check if they're in this category: Quoting a tweet from Joanna if Invisible Things Lab, on the topic of older hardware (than Purism's current choice): https://twitter.com/rootkovska/status/643414071514148864 "and old systems do not have IOMMU (VT-d) which makes them even less secure, trustworthy."
On Wed, Sep 16, 2015 at 10:48 AM, Blibbet <blibbet@gmail.com> wrote:
Quoting a tweet from Joanna if Invisible Things Lab, on the topic of older hardware (than Purism's current choice):
https://twitter.com/rootkovska/status/643414071514148864
"and old systems do not have IOMMU (VT-d) which makes them even less secure, trustworthy."
Question this in regards to number of gates available / needed for secret malefactor vs gatecount timeline vs time at which govt agencies and corp might desire and begin to cooperate or independantly perform same. ie: Are your your 486 or p55c and chipsets likely to contain malware? What about your Skylake? Given how ATT / Verizon / Sprint and others totally rolled over for Bush/911 what makes you think Intel or AMD or Microsoft are any different? WTF is up with windows 10? As if 7 vista and xp and Ubuntu Linux weren't enough. search: AnandTech, Intel has now stopped quoting gatecount with Skylake. https://en.wikipedia.org/wiki/NSAKEY
On 09/17/2015 12:00 PM, grarpamp wrote:
On Wed, Sep 16, 2015 at 10:48 AM, Blibbet <blibbet@gmail.com> wrote:
Quoting a tweet from Joanna if Invisible Things Lab, on the topic of older hardware (than Purism's current choice):
https://twitter.com/rootkovska/status/643414071514148864
"and old systems do not have IOMMU (VT-d) which makes them even less secure, trustworthy."
Question this in regards to number of gates available / needed for secret malefactor vs gatecount timeline vs time at which govt agencies and corp might desire and begin to cooperate or independantly perform same. ie: Are your your 486 or p55c and chipsets likely to contain malware? What about your Skylake? Given how ATT / Verizon / Sprint and others totally rolled over for Bush/911 what makes you think Intel or AMD or Microsoft are any different? WTF is up with windows 10? As if 7 vista and xp and Ubuntu Linux weren't enough.
search: AnandTech, Intel has now stopped quoting gatecount with Skylake. https://en.wikipedia.org/wiki/NSAKEY
Not trying to dis old refurbished x86s. Just pointing out a specific area to investigate w/r/t older x86 hardware. Joanna's tweet was one specfic case to look into. Pre-CHIPSEC, it is less clear to me. I wish I had a complete list of issues (i.e., the set of things to write for a CHIPSEC test profile for that hardware). Old Thinkpads are great, but a LIMITED resource, we can't just rely on old hardware forever. I wonder if Cyrix/Via/Transmeta/etc clones are also viable to be refurbished by Ministry of Freedom, and have any chance of being secure? I also wonder about MIPS and SunSPARC chips, they have some old boxes to refurbish, as well as some new MIPS boxes (a recent Chinese one not only runs MIPS but also x86 and ARM instructions!). If I were to hold out hope for an ISA that might be trustworthy, it would be the RISC-V. But that'll take a year or longer. The Raven3 board just came out, shown at HotChips. I hope that's the chip that Purism uses for their next laptop, along with the recent Open Hardware GPU, also announced at HotChips. Until then, I can update my own firmware on my ARM dev boards, and -- sans FSP blobs -- on Intel dev boards. And I have an ancient -- i.e., unknown security profile --- x86 with Libreboot. Wish Libreboot used coreboot's Verifed Boot, for a bit more protection, but that can be patched. Not sure about Win10. I've heard they have a freeware version, which is ad-sponsored, which must be be fun. Ubuntu, or as a friend of mine calls them, "Spybuntu", has been abusing privacy for years. I wouldn't ever trust an OS which is run by a single company. Debian isn't run by a single company. It isn't perfect, but has fewer than most. Does anyone have any opinion of Mempo, compared to QubesOS? I haven't used it yet, but it looks interesting. Qubes is great for Intel systems, but what about non-Intel, eg, ARM, does their isolation tech scale to non-Intel ISAs? If not, what OS should ARM users use? (Purism recently tweeted that they're going to get their PureOS to use parts of QubesOS. I don't presume to have a trustworthy or secure firmware, on any Intel box, perhaps AMD box, maybe ARM boxes. (The latter two seem to have less security research than Intel x86/x64 systems, if anyone has good pointers to ARM/AMD and other modern non-Intel HW, please speak up.) Eg: http://timeglider.com/timeline/5ca2daa6078caaf4 Or see last slide of most CHIPSEC or LebaCore talks, they have a good bibilography. Thanks.
participants (8)
-
Blibbet -
coderman -
dan＠geer.org -
Georgi Guninski -
grarpamp -
Juan -
odinn -
Steve Kinney