Matthew Garrett: What the fuck is an SBAT and why does everyone suddenly care

Short version: Secure Boot Advanced Targeting and if that's enough for you you can skip the rest you're welcome. Long version: When UEFI Secure Boot was specified, everyone involved was, well, a touch naive. The basic security model of Secure Boot is that all the code that ends u … | Continue reading


@mjg59.dreamwidth.org | 2 months ago

Matthew Garrett: Client-side filtering of private data is a bad idea

(The issues described in this post have been fixed, I have not exhaustively researched whether any other issues exist) Feeld is a dating app aimed largely at alternative relationship communities (think "classier Fetlife" for the most part), so unsurprisingly it's fairly popular i … | Continue reading


@mjg59.dreamwidth.org | 2 months ago

Matthew Garrett: SSH agent extensions as an arbitrary RPC mechanism

A while back, I wrote about using the SSH agent protocol to satisfy WebAuthn requests. The main problem with this approach is that it required starting the SSH agent with a special argument and also involved being a little too friendly with the implementation - things worked beca … | Continue reading


@mjg59.dreamwidth.org | 5 months ago

Matthew Garrett: Digital forgeries are hard

Closing arguments in the trial between various people and Craig Wright over whether he's Satoshi Nakamoto are wrapping up today, amongst a bewildering array of presented evidence. But one utterly astonishing aspect of this lawsuit is that expert witnesses for both sides agreed th … | Continue reading


@mjg59.dreamwidth.org | 8 months ago

Matthew Garrett: Debugging an odd inability to stream video

We have a cabin out in the forest, and when I say "out in the forest" I mean "in a national forest subject to regulation by the US Forest Service" which means there's an extremely thick book describing the things we're allowed to do and (somewhat longer) not allowed to do. It's a … | Continue reading


@mjg59.dreamwidth.org | 9 months ago

Matthew Garrett: Cloud desktops aren't as good as you'd think

Fast laptops are expensive, cheap laptops are slow. But even a fast laptop is slower than a decent workstation, and if your developers want a local build environment they're probably going to want a decent workstation. They'll want a fast (and expensive) laptop as well, though, b … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Handling WebAuthn over remote SSH connections

Being able to SSH into remote machines and do work there is great. Using hardware security tokens for 2FA is also great. But trying to use them both at the same time doesn't work super well, because if you hit a WebAuthn request on the remote machine it doesn't matter how much yo … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Bring Your Own Disaster

After my last post, someone suggested that having employers be able to restrict keys to machines they control is a bad thing. So here's why I think Bring Your Own Device (BYOD) scenarios are bad not only for employers, but also for users.There's obvious mutual appeal to having de … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: git signatures with SSH certificates

Last night I complained that git's SSH signature format didn't support using SSH certificates rather than raw keys, and was swiftly corrected, once again highlighting that the best way to make something happen is to complain about it on the internet in order to trigger the univer … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: UEFI rootkits and UEFI secure boot

Kaspersky describes a UEFI-implant used to attack Windows systems. Based on it appearing to require patching of the system firmware image, they hypothesise that it's propagated by manually dumping the contents of the system flash, modifying it, and then reflashing it back to the … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Responsible stewardship of the UEFI secure boot ecosystem

After I mentioned that Lenovo are now shipping laptops that only boot Windows by default, a few people pointed to a Lenovo document that:Starting in 2022 for Secured-core PCs it is a Microsoft requirement for the 3rd Party Certificate to be disabled by default."Secured-core" is a … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Lenovo shipping new laptops that only boot Windows by default

I finally managed to get hold of a Thinkpad Z13 to examine a functional implementation of Microsoft's Pluton security co-processor. Trying to boot Linux from a USB stick failed out of the box for no obvious reason, but after further examination the cause became clear - the firmwa … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Can we fix bearer tokens?

Last month I wrote about how bearer tokens are just awful, and a week later Github announced that someone had managed to exfiltrate bearer tokens from Heroku that gave them access to, well, a lot of Github repositories. This has inevitably resulted in a whole bunch of discussion … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: The Freedom Phone is not great at privacy

The Freedom Phone advertises itself as a "Free speech and privacy first focused phone". As documented on the features page, it runs ClearOS, an Android-based OS produced by Clear United (or maybe one of the bewildering array of associated companies, we'll come back to that later) … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Bearer tokens are just awful

As I mentioned last time, bearer tokens are not super compatible with a model in which every access is verified to ensure it's coming from a trusted device. Let's talk about that in a bit more detail.First off, what is a bearer token? In its simplest form, it's simply an opaque b … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: ZTA doesn't solve all problems, but partial implementations solve fewer

Traditional network access controls work by assuming that something is trustworthy based on some other factor - for example, if a computer is on your office network, it's trustworthy because only trustworthy people should be able to gain physical access to plug something in. If y … | Continue reading


@mjg59.dreamwidth.org | 2 years ago

AMD's Pluton implementation seems to be controllable

Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Boot Guard and PSB have user-hostile defaults

Continue reading


@mjg59.dreamwidth.org | 2 years ago

Matthew Garrett: Pluton is not (currently) a threat to software freedom

Continue reading


@mjg59.dreamwidth.org | 2 years ago

Does free software benefit from ML models being derived works of training data?

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Mike Lindell's Cyber “Evidence”

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Producing a trustworthy x86-based Linux appliance

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Xscreensaver: There's more than one way to exploit the commons

Continue reading


@mjg59.dreamwidth.org | 3 years ago

More Doorbell Adventures

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Unauthenticated MQTT endpoints on Linksys Velop routers enable local DoS

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Making hibernation work under Linux Lockdown

Continue reading


@mjg59.dreamwidth.org | 3 years ago

Making My Doorbell Work

Continue reading


@mjg59.dreamwidth.org | 4 years ago

Linux kernel lockdown, integrity, and confidentiality

Continue reading


@mjg59.dreamwidth.org | 4 years ago

Implementing support for advanced DPTF policy in Linux

Continue reading


@mjg59.dreamwidth.org | 4 years ago

What usage restrictions can we place in a free software license?

Continue reading


@mjg59.dreamwidth.org | 4 years ago

Avoiding gaps in IOMMU protection at boot

Continue reading


@mjg59.dreamwidth.org | 4 years ago

Verifying your system state in a secure and private way

Continue reading


@mjg59.dreamwidth.org | 4 years ago

WiFi deauthentication attacks and home security

Continue reading


@mjg59.dreamwidth.org | 4 years ago

Letting Birds scooters fly free

Continue reading


@mjg59.dreamwidth.org | 5 years ago

Investigating the Security of Lime Scooters

Continue reading


@mjg59.dreamwidth.org | 5 years ago

Do we need to rethink what free software is?

Continue reading


@mjg59.dreamwidth.org | 5 years ago

It's time to talk about post-RMS Free Software

Continue reading


@mjg59.dreamwidth.org | 5 years ago

Bug bounties and NDAs are an option, not the standard

Continue reading


@mjg59.dreamwidth.org | 5 years ago

Creating hardware where no hardware exists

Continue reading


@mjg59.dreamwidth.org | 5 years ago

Which smart bulbs should you buy (from a security perspective)

Continue reading


@mjg59.dreamwidth.org | 5 years ago

I bought some awful light bulbs so you don't have to (Reverse engineering)

Continue reading


@mjg59.dreamwidth.org | 6 years ago

Initial Thoughts on MongoDB's New Server Side Public License

Continue reading


@mjg59.dreamwidth.org | 6 years ago

Porting Coreboot to the 51NB X210

Continue reading


@mjg59.dreamwidth.org | 6 years ago

Porting Coreboot to the 51NB X210

Continue reading


@mjg59.dreamwidth.org | 6 years ago