Received-SPF: pass (google.com: domain of oss-security-return-30148-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Message-ID: <66402D07.6010804@gmail.com>
Date: Sat, 11 May 2024 21:44:23 -0500
From: Jacob Bachmeyer <jcb62281@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.22) Gecko/20090807 MultiZilla/1.8.3.4e SeaMonkey/1.1.17 Mnenhy/0.7.6.0
MIME-Version: 1.0
To: oss-security@lists.openwall.com
CC: Corey Lopez <Corey.lopez09160587@hotmail.com>
References: <BYAPR03MB4903AF4B05EDB627E47C9370EBE72@BYAPR03MB4903.namprd03.prod.outlook.com> <20240511112123.GA2064@openwall.com>
In-Reply-To: <20240511112123.GA2064@openwall.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [oss-security] Microsoft Device Firmware Configuration Interface
 (DFCI) in Linux efivars directory

Solar Designer wrote:
> Hi,
>
> Corey's message is confused and there's no indication in it whether the
> system was compromised, so that part doesn't need further discussion,
> but as a moderator I don't mind someone explaining Linux's (and other
> systems') exposure of the EFI variables and DFCI and what it means for
> security as well as what it does not.
>   

While he is definitely somewhat confused, he claims at the start to have 
detected a compromise, but does not give details about the indications 
that led him to that conclusion.

As far as I can tell from a quick perusal, (landing at 
<URL:https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Scenarios/DfciScenarios/>) 
it seems that DFCI "Zero Touch" is actually tightly bound to Microsoft 
cloud services, and there is supposed to be a local option to remove the 
zero touch certificate (thus disabling it more-or-less permanently) if 
DFCI is not in use on the machine.  The example implies that the UEFI 
configuration tool ("BIOS setup") should provide this option.


-- Jacob