search

nsacyber / Hardware-and-Firmware-Security-Guidance

Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance. #nsacyber
Other
753 stars 145 forks source link

Microsoft Surface devices _do_ support Secure Boot customization #6

Open out0xb2 opened 3 years ago

out0xb2 commented 3 years ago

Please remove documentation that incorrectly states that Microsoft Surface does not support UEFI Secure Boot customization. That was true for Surface RT & RT 2, but none of the modern PC class products - they all support programmatic customization after deleting the keys from the BIOS menu.

To customize Surface UEFI Secure Boot:

  1. Boot to Surface BIOS menu
  2. Find the BIOS Security page
  3. Click Secure Boot "Change Configuration"
  4. Select Secure Boot configuration "None"
  5. Exit, Save, reboot

All secure boot keys are now deleted. Boot to a UEFI Shell or the OS of your choice to install your preferred keys. Use SetVariable(), and set PK last. Reboot and enjoy!

I tested this last week using https://github.com/microsoft/mu_tiano_platforms/tree/release/202008/Platforms/OvmfPkg/EnrollDefaultKeys (but with my custom keys)

out0xb2 commented 3 years ago

@iadgovuser1 , perhaps you can ask 43313EB9AA87E7039F8F3948282E61C0CB12372C5499884609A01B2BCA37B973 if they would prefer a PR?

Also advise that some work here is duplicating effort, see here: https://github.com/tianocore/edk2-pytool-library/blob/master/edk2toollib/uefi/authenticated_variables_structure_support_test.py