LogoFAIL: Subverting UEFI Secure Boot

The Binarly Research Team recently presented LogoFAIL, a new exploit defeating UEFI Secure Boot.

In short, an attacker with access to the hard disk of a UEFI system could gain firmware-level control over the computer, even on a device using UEFI Secure Boot.  LogoFAIL appears to affect most UEFI implementations.

This is just the latest exploit of this nature. We’ve written about these before, and Binarly’s article lists several more.

UEFI Secure Boot – Delegated Security

UEFI Secure Boot delegates the security of your system to a signing authority, Microsoft.  Any bootloaders signed by Microsoft are valid, any not signed by Microsoft are not.  While a revocation list exists to ban buggy or malicious bootloaders that the authority signed, it is ineffective.  Devices rarely receive revocation list updates, and if they do, they must lag behind known exploits to avoid breaking systems that haven’t been updated yet.

In the meantime, a UEFI Secure Boot system is vulnerable if any bad signed binaries exist, even if they’re not intended for that system.  An attacker could place a broken Windows bootloader on a Linux system.

Compounding the problem, the UEFI firmware enforcing this policy isn’t authenticated to you.  There’s a good chance that an attacker with privileged disk access can also update your firmware, and they could likely roll it back to a vulnerable version without anyone noticing.

Finally, if you want the security offered by UEFI Secure Boot, you must use an OS approved by the signing authority.  Alternatively, your firmware might (or might not) allow you to set a custom signing key and operate your own signing authority.

Take Control

Photo of Librem Key inserted to Librem 14, with red LED lit

PureBoot’s security model puts you in charge.  PureBoot signs the boot files with rollback protection and tells you if the contents ever change – even if you signed them before.  Boot files that never appeared on your system before are not automatically accepted.

Signing new boot files requires your Librem Key and PIN, so you’ll know if new files are signed.  Even if a boot file exploit appeared in PureBoot, you’d know there was tampering before losing control.

Since PureBoot validates the boot files, you need to know that PureBoot is trustworthy.  That’s where the Librem Key comes in.  Librem Key tells you that your firmware is the same by blinking green.  If your firmware changes for any reason – even if it is firmware you had before – it blinks red.

As the owner, you are always in control.  You can change your own firmware all you like.  The Librem Key can’t prevent you from booting, it only tells you that it has changed.  You can always sign new boot files, or boot unsigned files, if you want.

Immediate Protection

PureBoot’s model protects you immediately, even if exploits in your OS or PureBoot were found.  Once you sign new boot files, the old files won’t be accepted, thanks to rollback protection.  Once you update firmware, the Librem Key will tell you if it’s rolled back, like any other change.

You don’t have to wait for a third party to revoke a broken bootloader, and then for another third party to update your firmware, if they ever do.  You’re protected immediately.

Purism Products and Availability Chart

 ModelStatusLead Time 
USB Security Token Purism Librem KeyLibrem Key

(Made in USA)
In Stock
($59+)
20 business days
Librem 5In Stock
($699+)
3GB/32GB
10 business days
Librem 5 COMSEC BundleIn Stock
($1299+)
Qty 2; 3GB/32GB
10 business days
Librem 5 + SIMple
(3 GB Data)
In Stock
($99/mo)
10 business days
Librem 5 + SIMple Plus
(5 GB Data)
In Stock
($129/mo)
10 business days
Librem 5 + AweSIM
(Unlimited Data)
In Stock
($169/mo)
10 business days
Librem 11In Stock
($999+)
8GB/1TB
45 business days
Most Secure Laptop Purism Librem 14Librem 14In Stock
($1,370+)
20 business days
Most Secure PC Purism Librem Mini
Librem MiniJune 2024
($799+)
45 business days
Purism Liberty Phone with Made in USA ElectronicsLiberty Phone
(Made in USA Electronics)
June 2024
($1,999+)
4GB/128GB
20 business days
Most Secure Server Purism Librem ServersLibrem ServerJune 2024
($2,999+)
60 business days
The current product and shipping chart of Purism Librem products, updated on April 30th, 2024

Recent Posts

Related Content

Tags