Comment by octoberfranklin
9 hours ago
Yeah but that just lets them replace the OS that gets booted.
This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.
9 hours ago
Yeah but that just lets them replace the OS that gets booted.
This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.
Do any of the locked down consoles or phones use a vulnerable UEFI implementation by any chance?
Phones most commonly use their own bootloader stack.
UEFI is pretty common on phones now, but it's unlikely that any of them are running this network stack there.
2 replies →