• 1 Post
  • 402 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle
  • What files do you have in /dev/nvme0n1p1?

    From the looks of it, that should be your linux boot partition.

    If you can, just remove every other drive temporarily while you focus on that specific drive. This will help avoid making changes to the windows bootloader.

    From there, boot into an arch iso, mount your btrfs subvolumes (i.e. /mnt and /mnt/home and /mnt/var/logs and whatever other subvolumes you have), mount your boot partition into your btrfs mount point (i.e /mnt/boot), and then arch-chroot into your system (/mnt).

    From there you’ll be in your actual system. If you’re using systemd-boot, run the bootctl install command. This will copy the systemd-boot UEFI boot manager to the ESP, create a UEFI boot entry for it and set it as the first in the UEFI boot order.

    If you are using grub, follow the grub guidelines for installing their bootloader (im not familiar with grub commands).

    Once that is done, go ahead and run mkinitcpio -P to make sure your kernel images are bootable options for your bootloader.

    After that, exit and unmount the boot and BTRFS subvolumes and reboot.

    That should get you back into your system.






  • Secure boot helps protect against evil maid attacks by checking hardware and OS signatures. If the boot process has been tampered with, the user can be alerted that the secure boot process can no longer properly verify signatures.

    While its probably true that you can no longer guarantee that system can be used safely ever again, at least you will be aware that it was tampered with and you can go ahead and send that system to e-waste and get you a new system.



  • Seems the issue here is that initramfs cant be signed for this attack to work. If it is signed, and an evil maid modifies the initramfs itself, it will break the secure boot process and the user will be notified that their system has been tampered with.

    If its not signed, and it drops to the debug shell, then the attacker can make any changes to your system without it affecting secure boot since it has already passed that stage. At least thats my understanding when I read this.








  • Radio is referring to the proprietary piece of hardware that is in every cell phone that handles the physical portion of transmitting radio waves for wireless connectivity. This piece of hardware generally handles LTE/5G, wifi, and bluetooth.

    Your IMEI is the identifier that is burned into that hardware, which uniquely lets the carriers determine if your device can authenticate on their networks.

    You can turn off the radio by disabling your cellular network or turning on airplane mode on your phone. You will temporarily lose access to your cellular network until you turn it back on.

    Newer devices don’t require SIM cards to connect. They have eSIM cards that can be used. You still need one or the other to connect to a cellular network.