Twitter | Pretraživanje | |
David Kaplan
My latest post: Understanding modern UEFI-based platform boot Complete with some possibly half-baked rambling thoughts on DRTM at the end
Reply Retweet Označi sa "sviđa mi se" More
Peter Bosch 15. kol
Odgovor korisniku/ci @depletionmode @qrs
and I actually did discover TOCTOUs in the IBB phase :
Reply Retweet Označi sa "sviđa mi se"
David Kaplan 15. kol
Odgovor korisniku/ci @peterbjornx @qrs
Well there we go! Great work. I'll add the link to your research to the blog post.
Reply Retweet Označi sa "sviđa mi se"
Graham Sutherland [Polynomial^DSS] 15. kol
Odgovor korisniku/ci @depletionmode
Nice article, although is there any chance you could bump up the contrast on the text on your site? My eyes aren't what they used to be.
Reply Retweet Označi sa "sviđa mi se"
David Kaplan 15. kol
Odgovor korisniku/ci @gsuberland
Thanks! Ye so sorry. Reading on mobile is a disaster (unless you're speaking about PC?). I am going to address this asap
Reply Retweet Označi sa "sviđa mi se"
vincent zimmer 14. kol
Odgovor korisniku/ci @depletionmode @0xAlexei
Nice write up. I’m a fan of modeling systems using Clark Wilson. We have some examples of this regarding the boot chain in . You can find other docs on EDKII security at including some threat modeling in
Reply Retweet Označi sa "sviđa mi se"
David Kaplan 14. kol
Odgovor korisniku/ci @vincentzimmer @0xAlexei
Thanks so much Vincent. I stole the Clark Wilson thing from you of course. :) (From somewhere in the Intel BGT flow docs). Thanks for the resources. Super helpful.
Reply Retweet Označi sa "sviđa mi se"
chris 15. kol
Odgovor korisniku/ci @depletionmode
Agree on why DRTM is suboptimal. Disagree on the SRTM reasoning: "The initial trust is rooted in the CPU+chipset vendor." That doesn't have to be true for SRTM - see Microsoft's Cerberus, or Google's Titan ( et al)
Reply Retweet Označi sa "sviđa mi se"
David Kaplan 15. kol
Odgovor korisniku/ci @hugelgupf
Thanks for pointing this out. I agree with you. I was speaking about SRTM as implemented in the run of the mill off-the-shelf Windows-based machine. I will amend the blog to make it clear that the root-of-trust is not necessarily the cpu vendor.
Reply Retweet Označi sa "sviđa mi se"
ralph waldo cybersyn 15. kol
Odgovor korisniku/ci @depletionmode @whitequark
i absolutely love the implication in the opening sentence that most of us use voodoo extensively
Reply Retweet Označi sa "sviđa mi se"
David Kaplan 15. kol
Odgovor korisniku/ci @atomicthumbs @whitequark
Not far off the truth here.. :)
Reply Retweet Označi sa "sviđa mi se"