this post was submitted on 07 Jul 2025
88 points (96.8% liked)
Linux
8334 readers
377 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Yeah, no duh. This isn't a critical security flaw unless you have the worst partition scheme on your encrypted volumes imaginable. It's not even a process flaw at that point, just "possible".
This is essentially what the Israeli government did to Android a decade ago with Pegasus: if you can get in front of the bootloader, you can compromise disks once encrypted because everything is happening in an in-memory boot process.
Same way you can hotwire cars. It's not new.
What’s the expression? If someone has physical access to your machine it’s no longer your machine.
XKCD about hacking in reality, a $5 monkey wrench, some rope, and kneecaps
I'm confused.
Initramfs is unencrypted in /boot when using LUKS with RAID. It has to be, right?
The attacker uses a debug shell to modify the unencrypted boot, so the next time you boot and type your LUKS password, they can gain access.
This doesn't line up with your comment?
How are you going to boot something that's encrypted without input to unlock it?
N
You always "boot something that is unencrypted." You then "mount" the encrypted volumes and load the OS.
This is how people can put an SSH server (dropbear) in initramfs so they can unlock remotely.
The attack is to initramfs, not the encrypted layer.
The order'ish:
I'm well aware. You're proving my point at mount.
But.. your original comment is just.. wrong?
The default LUKS partition scheme is vulnerable.
There is a successful POC, it is a flaw.
This is not just in-memory. This is modifying the unencrypted part of initramfs on disk. Powering off the machine does not remove the exploit.
Physical access = electronic waste
Thats how it has always been and always will be. If a threat actor had free access to your device for even just a couple seconds, its compromised rare earth trash.
Nope
Exactly.
Silicon is not a rare earth element.
Neither is Aluminium nor plastic nor Lithium (it's getting rarer alright, but doesn't fall into the category).
The amount of rare earth elements is really small in these devices.
Explain. The way i understand it, if somebody flashes malware into your firmware or bootloader then that device cant really be guaranteed to ever be safe again.
Secure boot helps protect against evil maid attacks by checking hardware and OS signatures. If the boot process has been tampered with, the user can be alerted that the secure boot process can no longer properly verify signatures.
While its probably true that you can no longer guarantee that system can be used safely ever again, at least you will be aware that it was tampered with and you can go ahead and send that system to e-waste and get you a new system.
i know this is not for PCs but GrapheneOS uses the Google Titan chip and this app to solve that problem.
might be a long time before we get similar hardware for PCs. the only thing that's remotely similar is the Apple T2 for MacBooks but there's no Linux distro with comparable security to GrapheneOS yet.
a raspi, soic8 clip and coreboot
isn't coreboot strictly for x86?
you use a soic8 clip and the raspi to connect directly to the SPI ROM on some other computer so you can flash coreboot on it without any obstructions