Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #161905 > unrolled thread

grub2 security problem

Back to article view | Back to linux.debian.user

Contents

  grub2 security problem Michael Fothergill <michael.fothergill@googlemail.com> - 2015-12-19 10:40 +0100
    Re: grub2 security problem Joe <joe@jretrading.com> - 2015-12-19 10:50 +0100
    Re: grub2 security problem Teemu Likonen <tlikonen@iki.fi> - 2015-12-19 10:50 +0100
    Re: grub2 security problem Brad Rogers <brad@fineby.me.uk> - 2015-12-19 13:10 +0100
      Re: grub2 security problem Michael Fothergill <michael.fothergill@googlemail.com> - 2015-12-19 13:20 +0100
    Re: grub2 security problem Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-12-19 18:20 +0100
      Re: grub2 security problem David Christensen <dpchrist@holgerdanske.com> - 2015-12-20 05:10 +0100
        Re: grub2 security problem Anders Andersson <pipatron@gmail.com> - 2015-12-20 16:10 +0100
          Re: grub2 security problem <tomas@tuxteam.de> - 2015-12-20 16:30 +0100
            Re: grub2 security problem Gene Heskett <gheskett@shentel.net> - 2015-12-20 16:50 +0100
        Re: grub2 security problem Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-12-20 17:10 +0100

#161905 — grub2 security problem

[Multipart message — attachments visible in raw view] — view raw

Dear Folks,

I noticed some articles suggesting that there is a security problem in
grub2.

E.g.

http://thehackernews.com/2015/12/hack-linux-grub-password.html

​Is there any substance to this?

Regards

Michael Fothergill



​

[toc] | [next] | [standalone]

#161906

On Sat, 19 Dec 2015 09:35:57 +0000
Michael Fothergill <michael.fothergill@googlemail.com> wrote:

> Dear Folks,
> 
> I noticed some articles suggesting that there is a security problem in
> grub2.
> 
> E.g.
> 
> http://thehackernews.com/2015/12/hack-linux-grub-password.html
> 
> ​Is there any substance to this?
> 

There was an update to grub2 in wheezy available a day or so ago, so
quite possibly.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#161907

[Multipart message — attachments visible in raw view] — view raw

Michael Fothergill [2015-12-19 09:35:57Z] wrote:

> I noticed some articles suggesting that there is a security problem in
> grub2.

> http://thehackernews.com/2015/12/hack-linux-grub-password.html
>
> ​Is there any substance to this?

Didn't check myself but it seems so:

https://www.debian.org/security/2015/dsa-3421
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

-- 
/// Teemu Likonen   - .-..   <https://github.com/tlikonen> //
// PGP: 4E10 55DC 84E9 DFF6 13D7 8557 719D 69D3 2453 9450 ///

[toc] | [prev] | [next] | [standalone]

#161908

[Multipart message — attachments visible in raw view] — view raw

On Sat, 19 Dec 2015 09:35:57 +0000
Michael Fothergill <michael.fothergill@googlemail.com> wrote:

Hello Michael,

>​Is there any substance to this?
​
Yes, but it's been rectified.  See
<https://lists.debian.org/debian-security-announce/2015/msg00327.html>
for the full security announcement.

Further, I suggest subscribing to the Debian Security Announcement
mailing list at
debian-security-announce-request@lists.debian.org?subject=subscribe

It's a low volume list, averaging less than one post per day.

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
Two sides to every story
Public Image - Public Image Ltd

[toc] | [prev] | [next] | [standalone]

#161909

[Multipart message — attachments visible in raw view] — view raw

On 19 December 2015 at 11:50, Brad Rogers <brad@fineby.me.uk> wrote:

> On Sat, 19 Dec 2015 09:35:57 +0000
> Michael Fothergill <michael.fothergill@googlemail.com> wrote:
>
> Hello Michael,
>
> >​Is there any substance to this?
> ​
> Yes, but it's been rectified.  See
> <https://lists.debian.org/debian-security-announce/2015/msg00327.html>
> for the full security announcement.
>

​Thanks a lot.   I ran grub update and did

​

​r​
oot@rhubarb:/home/michaelmikef# grub-install -V
​
and got​

grub-install (GRUB) 2.02~beta2-33

​I think this has fixed the problem.

Regards

MF​



> Further, I suggest subscribing to the Debian Security Announcement
> mailing list at
> debian-security-announce-request@lists.debian.org?subject=subscribe
>
> It's a low volume list, averaging less than one post per day.
>
> --
>  Regards  _
>          / )           "The blindingly obvious is
>         / _)rad        never immediately apparent"
> Two sides to every story
> Public Image - Public Image Ltd
>

[toc] | [prev] | [next] | [standalone]

#161919

Michael Fothergill <michael.fothergill@googlemail.com> writes:

> Dear Folks,
>
> I noticed some articles suggesting that there is a security problem in
> grub2.
>
> E.g.
>
> http://thehackernews.com/2015/12/hack-linux-grub-password.html
>
> ​Is there any substance to this?

Yes, for the microscopic proportion of people who put a password on
their bootloader in the first place, and for whom it is possible for
someone to to access their console to defeat it but not possible for
them to simply take the disk out and steal it.

[toc] | [prev] | [next] | [standalone]

#161926

On 12/19/2015 08:59 AM, Joe Pfeiffer wrote:
> Michael Fothergill <michael.fothergill@googlemail.com> writes:
>> I noticed some articles suggesting that there is a security problem in
>> grub2.
>>
>> E.g.
>>
>> http://thehackernews.com/2015/12/hack-linux-grub-password.html
>>
>> ​Is there any substance to this?
>
> Yes, for the microscopic proportion of people who put a password on
> their bootloader in the first place,

+1


(I had never heard of GRUB usernames/ passwords before today.  That 
sounds like more of an annoyance than security.)


A good defense against an attacker with physical access is LUKS 
encryption on all partitions except /boot.  Be sure to buy CPU's with 
AES-NI.


Another, additional, option is self-encrypting drives (SED), which are 
operating system agnostic and protect the entire contents of drive with 
zero CPU overhead.


David

[toc] | [prev] | [next] | [standalone]

#161937

On Sun, Dec 20, 2015 at 5:00 AM, David Christensen
<dpchrist@holgerdanske.com> wrote:
>
> Another, additional, option is self-encrypting drives (SED), which are
> operating system agnostic and protect the entire contents of drive with zero
> CPU overhead.

Emphasis on the word "additional" here. Unless you have access to the
source code and hardware that actually implements the drive
encryption, I would trust it about as far as I can throw the drive,
and I am not a strong man. There should not be any issues using it as
an additional layer under LUKS though, if you enjoy entering a lot of
passphrases. :)

[toc] | [prev] | [next] | [standalone]

#161939

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Dec 20, 2015 at 04:08:30PM +0100, Anders Andersson wrote:
> On Sun, Dec 20, 2015 at 5:00 AM, David Christensen
> <dpchrist@holgerdanske.com> wrote:
> >
> > Another, additional, option is self-encrypting drives (SED), which are
> > operating system agnostic and protect the entire contents of drive with zero
> > CPU overhead.
> 
> Emphasis on the word "additional" here. Unless you have access to the
> source code and hardware that actually implements the drive
> encryption, I would trust it about as far as I can throw the drive,

I'd like to see that ;-)

But seriously: given the history of firmware botches around (yes,
including encrypted harddisks), and given the keen interest of shady
state agencies [1] [2] (and that they prefer to work in the dark,
like vampires and cockroaches), I strongly agree with your throwing
sentiment.

[1] http://www.wired.com/2015/02/nsa-firmware-hacking/
[2] http://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/

- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZ2wFgACgkQBcgs9XrR2kZuCgCaAhGtWayXpk8COvFi4pTxAjwO
SDYAnRkGK7/LUJVxRbFXup8LgKszu6W9
=1LS1
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#161940

On Sunday 20 December 2015 09:51:04 tomas@tuxteam.de wrote:

> On Sun, Dec 20, 2015 at 04:08:30PM +0100, Anders Andersson wrote:
> > On Sun, Dec 20, 2015 at 5:00 AM, David Christensen
> >
> > <dpchrist@holgerdanske.com> wrote:
> > > Another, additional, option is self-encrypting drives (SED), which
> > > are operating system agnostic and protect the entire contents of
> > > drive with zero CPU overhead.
> >
> > Emphasis on the word "additional" here. Unless you have access to
> > the source code and hardware that actually implements the drive
> > encryption, I would trust it about as far as I can throw the drive,
>
> I'd like to see that ;-)
>
> But seriously: given the history of firmware botches around (yes,
> including encrypted harddisks), and given the keen interest of shady
> state agencies [1] [2] (and that they prefer to work in the dark,
> like vampires and cockroaches), I strongly agree with your throwing
> sentiment.
>
> [1] http://www.wired.com/2015/02/nsa-firmware-hacking/
> [2]
> http://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/
>
> -- t
Better yet, feed it to your wood chipper.  That should result in 
unreadable, unrecoverable encryption.  Highly recommended by Grandpa 
Gene. ;-)

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Some mill pix are at:
Genes Web page <http://geneslinuxbox.net:6309/gene/GO704-pix>

[toc] | [prev] | [next] | [standalone]

#161942

David Christensen a écrit :
> 
> A good defense against an attacker with physical access is LUKS 
> encryption on all partitions except /boot.

Ecryption alone does not protect agains attack scenarios involving /boot
tampering.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web