1

I have already identified a way to make an SD card truly read-only on HackaDay.

So let's consider this situation:

  • A third party have used dd to transfer the Linux image to an SD card
  • The PERM_WRITE_PROTECT bit is set and can not be changed
  • There is a hash of the image that will be checked on booting from the card
  • The developer have signed the hash with PGP and this is clearly stated online

The purpose of this card is to be able to boot a computer you already own and to know that what was intended to boot is actually running. Could uEFI or BIOS in a computer be compromised?

Security should enable the user to:

  • Generate a paper wallet
  • Print the wallet with a USB connected printer
  • (Other actions needing high security precautions)

To do this with confidence, both the SD card and the code to generate the keys must be verified (hash and PGP signatures) by the user. What am I missing? Are there any loopholes in this combination of hardware and software?

|improve this question
  • 1
    To answer this question, you have to clearly articulate which elements you do and don't trust. The Linux developers could have included a back door. The BIOS could be malicious. The printer could log all the pages it prints. The USB cable could have a sniffer that logs all the bits going through it. Et cetera. Which of these possibilities concern you? – Nate Eldredge Dec 25 '13 at 4:56
  • @nate-eldredge BIOS/UEFI would be my first concern, a "dumb" printer could be used (with no storage possibility). The last physical vulnerability that I take in to account is when the SD-card was written to by the third party. So sniffer USB cable is not included in my question. Niter is a hardware keylogger or any Tempest conserns included. – Jonas Oestman Dec 25 '13 at 13:34
  • I have removed the three tags that you created for this question and added paper-wallet. Please only add tags that are on-topic and will be useful in a broader scope on this SE. – Murch♦ Mar 27 '14 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.