How to Bypass Verified Boot Security in Chromium OS
This exposes a critical security vulnerability in Chromium OS, affecting users by potentially compromising encrypted data, though it is incremental as it exploits a specific flaw rather than introducing a new paradigm.
The authors identified a design flaw in Chromium OS's verified boot that allows an adversary to replace the root file system with a malicious one containing spyware or keyloggers, while still passing verification, as demonstrated experimentally by installing spyware that sends cached user data in plain text.
Verified boot is an interesting feature of Chromium OS that supposedly can detect any modification in the root file system (rootfs) by a dedicated adversary. However, by exploiting a design flaw in verified boot, we show that an adversary can replace the original rootfs by a malicious rootfs containing exploits such as a spyware or keylogger and still pass the verified boot process. The exploit is based on the fact that a dedicated adversary can replace the rootfs and the corresponding verification information in the bootloader. We experimentally demonstrate an attack using both the base and developer version of Chromium OS in which the adversary installs a spyware in the target system to send cached user data to the attacker machine in plain text which are otherwise encrypted, and thus inaccessible. We also demonstrate techniques to mitigate this vulnerability.