3 ms·

> Superfish was not a kernel rootkit by any measure of the word. I didn't say it was, you kinda ignored the context. The person who I replied to was asking how

> Superfish was not a kernel rootkit by any measure of the word. I didn't say it was, you kinda ignored the context. The person who I replied to was asking how can they trust their Windows is genuine, I replied to them that the feature causing a stir here does protect against some types of malware. It's a fair assumption that the next thing akin to Superfish would try to implant itself deeper, if given the chance, Device Guard does eliminate some of those ways. > for preinstalled software such as drivers If that driver is actually malicious then Early-Launch Antimalware alongside the kernel being protected, can get rid of it. > There would be absolutely no difference on whether you used Secure Boot or not. I wasn't talking exclusively about Secure Boot. > But worst of all: Superfish was actually _signed_ itself. Sure, now there's a toggle that won't trust some signatures that aren't as heavily vetted (amongst many other things). How is that "ridiculous" or "won't make a difference". Are you just looking for a reason to argue?

AshamedCaptain 4y ago
OK. You literally said: > [Device Guard] does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one. Which is the infamous Lenovo malware "preinstallation method" ? How would a signature system would have prevented malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image shipped with Lenovo hardware ?
- Avamander 4y ago
  > OK. You literally said: Yes, and I didn't call it a "kernel rootkit" as you said I did. > How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ? Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.
  - AshamedCaptain 4y ago
    Superfish was never shipped with WPBT (it was preinstalled), so please do make explicit which malware you are referring to.

AshamedCaptain 4y ago

OK. You literally said: > [Device Guard] does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one. Which is the infamous Lenovo malware "preinstallation method" ? How would a signature system would have prevented malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image shipped with Lenovo hardware ?

Avamander 4y ago
> OK. You literally said: Yes, and I didn't call it a "kernel rootkit" as you said I did. > How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ? Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.
- AshamedCaptain 4y ago
  Superfish was never shipped with WPBT (it was preinstalled), so please do make explicit which malware you are referring to.