As another poster mentioned, QubesOS with anti evil maid will work, but that’s the defense against state actors too and is overkill for this threat model.
BitLocker or any FDE using SecureBoot and PCR 7 will be sufficient for this (with Linux you also need PCRs 8+9 to protect against grub and initramfs attacks). Even if they can replace something in the boot chain with something trusted, it’ll change PCR 7 and you’d be prompted to unlock with a recovery key (don’t blindly enter it without verifying the boot chain and knowing why you’re being prompted).
With Secure Boot alone, the malicious bootloader would still need to be trusted (something like BlackLotus).
Also make sure you have a strong BIOS password and disable boot from USB, PXE, and anything else that isn’t the specific EFI bootloader used by your OS(es).
Yeah this article is complete garbage. Who upvotes this stuff?
I will never understand how anyone could come to thinking aspic was a good idea.
And what about taking a nice drive down Jean Baptiste Pointe du Sable Lake Shore Drive?
Not that it’s my first recommendation for security reasons, and I would never do this in prod, but you can just add the self-signed cert to the local trusted root CA store and it should work fine. No reg changes needed.
If you do this, put it in the store of the user running the client, not LocalMachine. Then you just need to make sure you connect as something in the cert’s SAN list. An IP might work (don’t know since I never try to put IPs in the SAN list), but just use a hosts entry if you can’t modify local DNS.
Edit: after reading the full OP post (sorry), I don’t think it’s necessarily the self-signed cert. If the browser is connecting with https:// and presenting a basic auth prompt, then https is working. It almost sounds like there is a 301/302 redirect back to http after login. Check the Network tab of the browser’s dev pane (F12) to see what is going on.
Wow Forbes cybersecurity reporting is absolute dog shit. So much text to say absolutely nothing useful.
Anyway, this is just an AITM redirection onto a malicious site in the middle that pretends to be the MFA portal and intercept the session cookie.
I’m guessing most of the younger crowd here has never seen When Harry Met Sally.
Microsoft uses TPM PCRs 7+11 for BitLocker which is more secure than the Linux implementations mentioned in the article.
PCR 7 is the Secure Boot measurement which means it can’t be unlocked unless every signed boot component has not been tampered with up to the point of unlock by the EFI bootloader. PCR 11 is simply flipped from a 0 to a 1 by the bootloader to protect the keys from being extracted in user land from an already booted system.
The article is correct that most Linux implementations blindly following these kinds of “guides” are not secure. Without additional PCRs, specifically 8 and 9 measuring the grub commands (no single-user bypass) and initrd (which is usually on an unencrypted partition), it is trivial to bypass. But the downside of using these additional PCRs is that you need to manually unlock with a LUKS2 password and reseal the keys in TPM whenever the kernel and or initrd updates.
Of course to be really secure, you want to require a PIN in addition to TPM to unlock the disk under any OS. But Microsoft’s TPM-only implementation is fairly secure with only a few advanced vulnerabilities such as LogoFAIL and cold boot attacks.
most of those drinks are specifically designed with the ice in mind
Citation Needed
I use it for providing a text summary of YouTube videos that I can parse quickly. Because everything has to be a gorram video these days.
Or at least mark it NSFW. 😅
This almost describes mine and my wife’s experience to a tee.
I feel bad for anyone trying to date online in this enshittified world today.
Yeah I was terrified of the headline at first, but after reading the article came to the same basic conclusion as you.
At first I thought they were going to find a way to trade our 401(k)s without our consent like the mortgage-backed securities from pre-2008.
You can order it dipped, wet, or dry. Wet is the traditional so it usually just has one or two ladles of juice poured over it. Dipped is when they dunk the whole thing. But the bread is high quality so it can usually take it. I prefer wet myself (hehe).
Probably the 9950x3d. And we’ve known for a while now that the cache would only be on one CCD.
Yeah you really need a password or TPM PIN protector to protect from cold boot attacks if that is in your threat model.
Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.
This is not true.
You would additionally need to bypass Secure Boot with a separate exploit such as the one in this article (which is mitigated by disabling USB boot) or LogoFAIL to put the TPM PCRs in a state where the keys can be released.
LUKS2 is no different here as either can be TPM-only or require a separate PIN.
Linux on enterprise user endpoints is an insane proposition for most organizations.
You clearly have no experience managing thousands of endpoints securely.
Yep that’s how I have Syncthing set up. All global and local discovery disabled, no firewall ports open on the clients, no broadcasting, no relay servers. Just syncing through a central server which maintains versioning and where the backups run. Works like a charm.