6 ms·

Because now a random fob jammed into your laptop won't be loaded on boot without the explicit choice to load it. This is defense-in-depth level stuff.

by Jenk 4y ago

vetinari 4y ago
It cannot be a random fob; it has to be a fob signed by Microsoft's 3rd Party UEFI CA key. They do not sign everything nilly-willy; they refused to sign grub, that's why linux distros use shim.efi.
- laumars 4y ago
  That's the point the GP was making
  - vetinari 4y ago
    Then he did it wrong, because the point of the article is that systems signed with exactly this key are not trusted anymore. Only different key is trusted, and that key is used to sign Windows only and nothing else.
    - laumars 4y ago
      Yes, we all already understand the context. One could argue that distrusting platforms signed with MS's 3rd party certificate offers marginal additional security but that doesn't contradict the original point made about defence in depth.
      - vetinari 4y ago
        Whether it offers marginal additional security has yet to be demonstrated. But it certainly does damage the competition.
        laumars 4y ago
        > Whether it offers marginal additional security has yet to be demonstrated. You're further limiting the number of images that can boot. This is a point you've made yourself so I don't really see how you need a further demonstration. What you can argue is whether that marginal additional security is negligible enough be pragmatically worthless. And I'd probably agree with you there. However that doesn't dismiss the point that it does add a marginal additional security from the perspective of "defence in depth"[1] [1] https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing) > But it certainly does damage the competition. I'm not convinced it does in any meaningful way. Maybe (again) marginally it might but it's trivial to disable and most Linux users are probably used to jumping into the uEFI to enable booting from install medias anyway (I know I am). I'd argue your statement here requires a greater burden of proof than the one you're arguing against.
        vetinari 4y ago
        > You're further limiting the number of images that can boot. That does not mean it improves security. If the images it allows to boot are less secure than those it prevents, it lessens security. > I'm not convinced it does in any meaningful way. It does booting Linux harder exactly to these users that it claims to protect. So yes, it "protects" them from trying competing product. > disable and most Linux users are probably used to jumping into the uEFI to enable booting from install medias anyway (I know I am). Power users can do it; less experienced users consider that difficult, especially if they are not familiar with the concept. This all contributes to the image that Linux is difficult to install and use. Linux forums are full of discussions on this topic. While it is just an artificial hindrance. Would be it OK for Windows users to fiddle with UEFI settings before they can use Windows? If not, why is it OK for Linux users? Windows gets a clear advantage here.
        laumars 4y ago
        > That does not mean it improves security. If the images it allows to boot are less secure than those it prevents, it lessens security. I appreciate what you're saying but your logic doesn't really work: - The only image allowed is Windows. Anything else is disallowed. Those images might be malicious (eg someone somehow stole MS 3rd party cert) or they might not. But not allowing them is more secure than allowing them because you're reducing your risk. - Furthermore, saying some images allowed are less secure (ie Windows) than the ones that aren't (eg CentOS) doesn't mean this "feature" (if you can call it that) doesn't still add some additional security. Because (and at risk of repeating the above), this still blocks some additional images that might be a security risk. Hence it reducing your risk and hence it providing additional security from the perspective of defence in depth. - The point of "defence in depth" is not to have a single security countermeasure that acts as a silver bullet against attacks. It's to provide a layered approach where cumulatively they protect you. This "feature" certainly fits that criteria. This is why I said the question shouldn't be "does it provide additional security?" but rather "is that additional security significant enough to warrant the other impacts (such as those you've outlined?" If you were to make that point instead, then I might agree with you. But to say it doesn't provide any additional security really misses the point of how security is evaluated. > > I'm not convinced it does in any meaningful way. > It does booting Linux harder exactly to these users that it claims to protect. That's not a counterargument, it's a contradiction. I don't really see the point of a "oh yes it does" / "oh no it doesn't" pantomime style argument. If you are able to cite how the short activity of unchecking an additional UEFI option is significant enough to turn people off from the already complicated process of installing Linux then I'd be interested to see it. Otherwise we might just have to agree to disagree. > Power users can do it; less experienced users consider that difficult, especially if they are not familiar with the concept. This all contributes to the image that Linux is difficult to install and use. Linux forums are full of discussions on this topic. But how many of those people are buying ThinkPads to install Linux who are not power users? I'd wager if you were to draw a Venn diagram, those groups would barely, if at all, intersect. And more often than not, you have to alter UEFA parameters to boot from removable devices regardless of your setting in secure boot. > Would be it OK for Windows users to fiddle with UEFI settings before they can use Windows? If not, why is it OK for Linux users? Windows gets a clear advantage here. This I do 100% agree with. I never liked secure boot to begin with because of exactly this reason. Still dislike it now and certainly don't agree with what Lenovo are doing with regards to the original topic. But that is an entirely separate point to the one made previously about defence in depth. Here I think lies the issue of our discussion. You're arguing against a technical point with an emotional claim of morality. While I completely agree with your point about morality, it's doesn't address the technical point you're trying to argue against.
mjg59 4y ago
If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you're going to posit an attack scenario then please describe the entire sequence of events and where the attack would be prevented by this configuration.
- Jenk 4y ago
  It happens at airports, coffee shops, etc. Anywhere there are people working in public places. Jam a fob in, force a reboot, ransomware now loaded (for one example)
  - mjg59 4y ago
    Force a reboot, jam a fob in, hit F1, cursor down three times, tab, down five times, space, F12, ransomware now loaded, except: System doesn't boot because PCR 7 is now different, just like it would be if you didn't have to do those additional (rapid) keypresses. This is not the threat model you're looking for.
- badcppdev 4y ago
  I see it as quite feasible that an attacker could insert a fob or organise for a fob to be inserted without also having opportunity to reboot the computer. That fob could then compromise the system when the computer was rebooted. The Lenovo bios setting being discussed would prevent that. BTW Can you clarify if you think the feature from Lenovo is a good or a bad thing given your claim that it's very easy to disable?
  - mjg59 4y ago
    The boot variables won't point at the device, and so the firmware will never bother to scan the device. The bios setting therefore provides no additional security in this scenario.
- deepsun 4y ago
  Attacker leaves a USB stick somewhere on a parking lot, and curious employee plugs it in to see what's there, and reboots machine (or USB stick makes it reboot).
Cthulhu_ 4y ago
> This is defense-in-depth level stuff. Wouldn't even call it "in depth", disallowing an alternative boot should be one of the first things any decent IT staff should do on any company machines, and therefore so should direct-to-consumer pre-installed tech like this. 99% of computer users are just consumers, nobody should have to think about security when they first get a new system beyond setting a password.
deleted 4y ago
[deleted]
AshamedCaptain 4y ago
It wouldn't have loaded on boot without an explicit choice even with the MS UEFI CA signature loaded.

Because now a random fob jammed into your laptop won't be loaded on boot without the explicit choice to load it. This is defense-in-depth level stuff.

by Jenk 4y ago

Because now a random fob jammed into your laptop won't be loaded on boot without the explicit choice to load it. This is defense-in-depth level stuff.

vetinari 4y ago

It cannot be a random fob; it has to be a fob signed by Microsoft's 3rd Party UEFI CA key. They do not sign everything nilly-willy; they refused to sign grub, that's why linux distros use shim.efi.

laumars 4y ago
That's the point the GP was making
- vetinari 4y ago
  Then he did it wrong, because the point of the article is that systems signed with exactly this key are not trusted anymore. Only different key is trusted, and that key is used to sign Windows only and nothing else.
  - laumars 4y ago
    Yes, we all already understand the context. One could argue that distrusting platforms signed with MS's 3rd party certificate offers marginal additional security but that doesn't contradict the original point made about defence in depth.
    - vetinari 4y ago
      Whether it offers marginal additional security has yet to be demonstrated. But it certainly does damage the competition.
      - laumars 4y ago
        > Whether it offers marginal additional security has yet to be demonstrated. You're further limiting the number of images that can boot. This is a point you've made yourself so I don't really see how you need a further demonstration. What you can argue is whether that marginal additional security is negligible enough be pragmatically worthless. And I'd probably agree with you there. However that doesn't dismiss the point that it does add a marginal additional security from the perspective of "defence in depth"[1] [1] https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing) > But it certainly does damage the competition. I'm not convinced it does in any meaningful way. Maybe (again) marginally it might but it's trivial to disable and most Linux users are probably used to jumping into the uEFI to enable booting from install medias anyway (I know I am). I'd argue your statement here requires a greater burden of proof than the one you're arguing against.
        vetinari 4y ago
        > You're further limiting the number of images that can boot. That does not mean it improves security. If the images it allows to boot are less secure than those it prevents, it lessens security. > I'm not convinced it does in any meaningful way. It does booting Linux harder exactly to these users that it claims to protect. So yes, it "protects" them from trying competing product. > disable and most Linux users are probably used to jumping into the uEFI to enable booting from install medias anyway (I know I am). Power users can do it; less experienced users consider that difficult, especially if they are not familiar with the concept. This all contributes to the image that Linux is difficult to install and use. Linux forums are full of discussions on this topic. While it is just an artificial hindrance. Would be it OK for Windows users to fiddle with UEFI settings before they can use Windows? If not, why is it OK for Linux users? Windows gets a clear advantage here.
        laumars 4y ago
        > That does not mean it improves security. If the images it allows to boot are less secure than those it prevents, it lessens security. I appreciate what you're saying but your logic doesn't really work: - The only image allowed is Windows. Anything else is disallowed. Those images might be malicious (eg someone somehow stole MS 3rd party cert) or they might not. But not allowing them is more secure than allowing them because you're reducing your risk. - Furthermore, saying some images allowed are less secure (ie Windows) than the ones that aren't (eg CentOS) doesn't mean this "feature" (if you can call it that) doesn't still add some additional security. Because (and at risk of repeating the above), this still blocks some additional images that might be a security risk. Hence it reducing your risk and hence it providing additional security from the perspective of defence in depth. - The point of "defence in depth" is not to have a single security countermeasure that acts as a silver bullet against attacks. It's to provide a layered approach where cumulatively they protect you. This "feature" certainly fits that criteria. This is why I said the question shouldn't be "does it provide additional security?" but rather "is that additional security significant enough to warrant the other impacts (such as those you've outlined?" If you were to make that point instead, then I might agree with you. But to say it doesn't provide any additional security really misses the point of how security is evaluated. > > I'm not convinced it does in any meaningful way. > It does booting Linux harder exactly to these users that it claims to protect. That's not a counterargument, it's a contradiction. I don't really see the point of a "oh yes it does" / "oh no it doesn't" pantomime style argument. If you are able to cite how the short activity of unchecking an additional UEFI option is significant enough to turn people off from the already complicated process of installing Linux then I'd be interested to see it. Otherwise we might just have to agree to disagree. > Power users can do it; less experienced users consider that difficult, especially if they are not familiar with the concept. This all contributes to the image that Linux is difficult to install and use. Linux forums are full of discussions on this topic. But how many of those people are buying ThinkPads to install Linux who are not power users? I'd wager if you were to draw a Venn diagram, those groups would barely, if at all, intersect. And more often than not, you have to alter UEFA parameters to boot from removable devices regardless of your setting in secure boot. > Would be it OK for Windows users to fiddle with UEFI settings before they can use Windows? If not, why is it OK for Linux users? Windows gets a clear advantage here. This I do 100% agree with. I never liked secure boot to begin with because of exactly this reason. Still dislike it now and certainly don't agree with what Lenovo are doing with regards to the original topic. But that is an entirely separate point to the one made previously about defence in depth. Here I think lies the issue of our discussion. You're arguing against a technical point with an emotional claim of morality. While I completely agree with your point about morality, it's doesn't address the technical point you're trying to argue against.

mjg59 4y ago

If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you're going to posit an attack scenario then please describe the entire sequence of events and where the attack would be prevented by this configuration.

Jenk 4y ago
It happens at airports, coffee shops, etc. Anywhere there are people working in public places. Jam a fob in, force a reboot, ransomware now loaded (for one example)
- mjg59 4y ago
  Force a reboot, jam a fob in, hit F1, cursor down three times, tab, down five times, space, F12, ransomware now loaded, except: System doesn't boot because PCR 7 is now different, just like it would be if you didn't have to do those additional (rapid) keypresses. This is not the threat model you're looking for.
badcppdev 4y ago
I see it as quite feasible that an attacker could insert a fob or organise for a fob to be inserted without also having opportunity to reboot the computer. That fob could then compromise the system when the computer was rebooted. The Lenovo bios setting being discussed would prevent that. BTW Can you clarify if you think the feature from Lenovo is a good or a bad thing given your claim that it's very easy to disable?
- mjg59 4y ago
  The boot variables won't point at the device, and so the firmware will never bother to scan the device. The bios setting therefore provides no additional security in this scenario.
deepsun 4y ago
Attacker leaves a USB stick somewhere on a parking lot, and curious employee plugs it in to see what's there, and reboots machine (or USB stick makes it reboot).

Cthulhu_ 4y ago

> This is defense-in-depth level stuff. Wouldn't even call it "in depth", disallowing an alternative boot should be one of the first things any decent IT staff should do on any company machines, and therefore so should direct-to-consumer pre-installed tech like this. 99% of computer users are just consumers, nobody should have to think about security when they first get a new system beyond setting a password.

deleted 4y ago

[deleted]

AshamedCaptain 4y ago

It wouldn't have loaded on boot without an explicit choice even with the MS UEFI CA signature loaded.