4 ms·

TL;DR: Microsoft's Secure Boot bootloader is vulnerable to an attack where you use a (Microsoft-signed) supplemental boot policy instead of a regular boot polic

by ge0rg 10y ago

TL;DR: Microsoft's Secure Boot bootloader is vulnerable to an attack where you use a (Microsoft-signed) supplemental boot policy instead of a regular boot policy, effectively removing the Secure Boot lock and allowing to run unsigned code. This affects locked devices (Windows RT, Phone, ...) and might be used for jailbreaking devices as well as to attack their security.

cocotino 10y ago
Won't you need another exploit to do this on RT/Phone? It's not like they allow you to write to arbitrary files by default...
- my123 10y ago
  on RT, you don't need another exploit at all :) It allows you to run the command prompt as admin by default
  - ktta 10y ago
    forgive my limited knowledge in this, but I have an RT and wondering what I can do with it. What can I do with it and how? Any links/resources? thanks EDIT: saw your other comments :) I'm still up for more info if you have any regarding installing new apps or OS on RT
- slipstream- 10y ago
  On Phone, the exploit chain to do exactly that is already public.
OrangeTux 10y ago
> can be used for jailbreaking devices as well as to attack their security. This sounds quite negative. Another (very postive) consequence is to install unsigned OS'es (read: Linux).
- vox_mollis 10y ago
  [edit] I was uninformed, there is no delete option.
  - xpaulbettsx 10y ago
    Surface Pro / Surface Book can disable secure boot without hacks, this only applies to Surface RT (i.e. the ARM one)
- ge0rg 10y ago
  I tried to remain as neutral as possible with the summary. My personal opinion is that it should be possible for the owner of a device to install any OS they wish, and do so without compromising the device security. Unfortunately, we are very far away from that goal. Either there is no (official) way to unlock the bootloader, or we get a full unlock where everybody with physical access to the device can install whatever rootkit they wish.
  - mixedCase 10y ago
    >Unfortunately, we are very far away from that goal. Not at all. It's commonplace in UEFI motherboards. You can supply your own keys and then sign your kernel/bootloader. Microsoft just decided the owners of these devices should not be allowed to control their device's boot process.
    - soylentcola 10y ago
      I think that's why the "jailbreak" wording I've seen used is fairly appropriate. The flip side to the risks that result from trusting some sort of locked bootloader for security also mean that you can gain more control over your gear. On one hand, I think that aspect is wonderful news but on the other hand, there are already a lot of options for devices with unlocked (or unlockable) bootloaders and some orgs may have specifically desired the locked option as part of their security setup and this undermines that. The only thing that is relevant regardless is how it illustrates the flaws in any system that relies on secret master keys/backdoors

by ge0rg 10y ago

cocotino 10y ago

Won't you need another exploit to do this on RT/Phone? It's not like they allow you to write to arbitrary files by default...

my123 10y ago
on RT, you don't need another exploit at all :) It allows you to run the command prompt as admin by default
- ktta 10y ago
  forgive my limited knowledge in this, but I have an RT and wondering what I can do with it. What can I do with it and how? Any links/resources? thanks EDIT: saw your other comments :) I'm still up for more info if you have any regarding installing new apps or OS on RT
slipstream- 10y ago
On Phone, the exploit chain to do exactly that is already public.

OrangeTux 10y ago

> can be used for jailbreaking devices as well as to attack their security. This sounds quite negative. Another (very postive) consequence is to install unsigned OS'es (read: Linux).

vox_mollis 10y ago
[edit] I was uninformed, there is no delete option.
- xpaulbettsx 10y ago
  Surface Pro / Surface Book can disable secure boot without hacks, this only applies to Surface RT (i.e. the ARM one)
ge0rg 10y ago
I tried to remain as neutral as possible with the summary. My personal opinion is that it should be possible for the owner of a device to install any OS they wish, and do so without compromising the device security. Unfortunately, we are very far away from that goal. Either there is no (official) way to unlock the bootloader, or we get a full unlock where everybody with physical access to the device can install whatever rootkit they wish.
- mixedCase 10y ago
  >Unfortunately, we are very far away from that goal. Not at all. It's commonplace in UEFI motherboards. You can supply your own keys and then sign your kernel/bootloader. Microsoft just decided the owners of these devices should not be allowed to control their device's boot process.
  - soylentcola 10y ago
    I think that's why the "jailbreak" wording I've seen used is fairly appropriate. The flip side to the risks that result from trusting some sort of locked bootloader for security also mean that you can gain more control over your gear. On one hand, I think that aspect is wonderful news but on the other hand, there are already a lot of options for devices with unlocked (or unlockable) bootloaders and some orgs may have specifically desired the locked option as part of their security setup and this undermines that. The only thing that is relevant regardless is how it illustrates the flaws in any system that relies on secret master keys/backdoors