Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <66402D07.6010804@gmail.com>
Date: Sat, 11 May 2024 21:44:23 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
CC: Corey Lopez <Corey.lopez09160587@...mail.com>
Subject: Re: Microsoft Device Firmware Configuration Interface
 (DFCI) in Linux efivars directory

Solar Designer wrote:
> Hi,
>
> Corey's message is confused and there's no indication in it whether the
> system was compromised, so that part doesn't need further discussion,
> but as a moderator I don't mind someone explaining Linux's (and other
> systems') exposure of the EFI variables and DFCI and what it means for
> security as well as what it does not.
>   

While he is definitely somewhat confused, he claims at the start to have 
detected a compromise, but does not give details about the indications 
that led him to that conclusion.

As far as I can tell from a quick perusal, (landing at 
<URL:https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Scenarios/DfciScenarios/>) 
it seems that DFCI "Zero Touch" is actually tightly bound to Microsoft 
cloud services, and there is supposed to be a local option to remove the 
zero touch certificate (thus disabling it more-or-less permanently) if 
DFCI is not in use on the machine.  The example implies that the UEFI 
configuration tool ("BIOS setup") should provide this option.


-- Jacob

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.