4 ms·
This is about using Secure Boot, not disabling it. The author wants to boot third party software, signed by Microsoft, but Lenovo disabled this unless you go in
by Aissen 4y ago
This is about using Secure Boot, not disabling it. The author wants to boot third party software, signed by Microsoft, but Lenovo disabled this unless you go in the firmware settings: they only allow software from Microsoft, not signed by them for third parties. As said elsewhere in the thread, it has no real use, except maybe delaying an attacker by a few seconds (and then again, that attacker won't access any data, so…).
- Avamander 4y ago> hey only allow software from Microsoft, not signed by them for third parties. Not the entire picture here, that option is a part of a more holistic set of measures Microsoft calls Device Guard (part of Secured Core) > it has no real use, except maybe delaying an attacker by a few seconds (and then again, that attacker won't access any data, so…). It does prevent potential abuse of the signed shim that's not very difficult to get signed by. E.g. nobody can install the signed shim to rootkit a Windows installation.
- Aissen 4y ago> It does prevent potential abuse of the signed shim that's not very difficult to get signed by. E.g. nobody can install the signed shim to rootkit a Windows installation. How would that worked if combined with FDE + TPM ?
- Avamander 4y agoFor the average user, FDE is unlikely to be enabled by default. But yes, Secure Boot's measurements with BitLocker would prevent this as well. Though seeing a recovery screen will not inform you that your bootloader has been tampered with and by entering a recovery key you're basically authorizing the malware to run.
- jeroenhd 4y agoWithout FDE, modification of the file system to create autoruns and system services is so easy that you wouldn't need to go through the effort of using a bootloader. Just pop out the storage device or boot a Windows install disk and run some software.
- Avamander 4y agoTrue, but that assumes physical access, malware probably does not have that.
- philliphaydon 4y ago>As said elsewhere in the thread, it has no real use, except maybe delaying an attacker by a few seconds Does this not assume that the bios is not password protected, old dell laptops you need to jump 2 pins on the motherboard to bypass password protected bios and reset it. Don't think this works on newer ones.