  Verified boot is an interesting feature of Chromium OS that supposedly can
detect any modification in the root file system (rootfs) by a dedicated
adversary. However, by exploiting a design flaw in verified boot, we show that
an adversary can replace the original rootfs by a malicious rootfs containing
exploits such as a spyware or keylogger and still pass the verified boot
process. The exploit is based on the fact that a dedicated adversary can
replace the rootfs and the corresponding verification information in the
bootloader. We experimentally demonstrate an attack using both the base and
developer version of Chromium OS in which the adversary installs a spyware in
the target system to send cached user data to the attacker machine in plain
text which are otherwise encrypted, and thus inaccessible. We also demonstrate
techniques to mitigate this vulnerability.
