7 ms·

Sounds like the same anti competitive behavior that MS was punished for two decades ago. Making it a requirement to only boot software approved by them excludes

Sounds like the same anti competitive behavior that MS was punished for two decades ago. Making it a requirement to only boot software approved by them excludes a whole range of competitors from using the same hardware. Making that a condition for OEMs to even get a license is the problem here. Lenovo is otherwise known for supporting Linux on their laptops. And yes I know you can jump through hoops and fiddle with scary (for ordinary users) bios options to "fix" this. The point is that you shouldn't have to and this is a bit too convenient for MS to keep competitors off laptops. Basically, what is needed here is a neutral certificate authority not controlled by a single company with a reasonable process for independent operating systems to get a certificate. I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off.

Arnavion 4y ago
>I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off. Does it also not let you use your own keys? Because if it does, you don't have to turn SB off, just use your key to sign the UKI and a bootloader like systemd-boot. It should work with any distro, especially one that uses dracut to create the initramfs because it's a couple of lines of dracut config to generate a (signed) UKI instead.
- jillesvangurp 4y ago
  Not in a way that is obvious to me. I'm sure you can work around it but if you just want to boot a live image and run an installer, ubuntu works and not a whole lot of other distributions do (because their installers don't support secure boot). I assume this is because of how much of a PITA it is to get certified.
  - Arnavion 4y ago
    >I assume this is because of how much of a PITA it is to get certified. Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. But yes, it might be that the live CDs don't do that; I don't know. My experience with SB on all my machines has been to start with SB disabled and then I enable it afterwards with my own keys. I know the gparted and OpenSUSE live CDs support SB because I've booted off them after enabling SB. You could boot the Ubuntu live CD (or something smaller like gparted), mount the other distro's live CD, chroot into it, and run the other distro's installer that way. Just be sure that you enable SB support so that the installation actually boots afterwards.
    - AshamedCaptain 4y ago
      > Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. You still have to get your own version of shim signed if you want your distro to boot "Scary Boot Prompt"-free. I.e. if you just use RedHat's version of shim, that shim will transparently boot RedHat signed kernels, but refuse to boot SuSE's -- unless you whitelist SuSE's key manually into shim. It's not ideal in any way.
      - Arnavion 4y ago
        I believe for OpenSUSE it uses MokManager to get the user to trust the OpenSUSE CA. But it's been a while since I tried it so I might be misremembering. (MokManager is broken on my mobo so I switched to systemd-boot + my own signing keys, which is better for security anyway.)
Kipters 4y ago
Not disagreeing with the general message, but IMHO if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal. As far as I'm concerned as long as it's possible to re-enable the 3rd Party CA (or disable Secure Boot altogether) it's not tragic considering this only applies to a specific kind of machines ("Secured Core PCs") and not to mainstream ones
- jillesvangurp 4y ago
  There's a difference between stick in a usb key to fiddle with bios in vendor specific way and then stick a usb key in. It's an extra hurdle. If your instructions read: "turn off secure boot", MS has already won. Some users will, most won't, and many company IT departments would not allow you to on principle (because it's company hardware and they want it secured because it is their problem if it isn't).
  - Avamander 4y ago
    > If your instructions read: "turn off secure boot" That's the thing, you don't have to disable that. You just have to re-enable that CA if you have a model that has Device Guard enabled by default. > It's an extra hurdle. Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing.
    - noisy_boy 4y ago
      > Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing. That assertion is a bit too absolute; I am comfortable installing an OS using the USB installer because I have done it many times. I haven't had to change UEFI settings yet and I'm worried that doing something wrong will lock me out (in case of a botched OS install, I can just start over).
      - Avamander 4y ago
        Fair, that fear can be real, but it does sound rare and I think that's what the user manual is for. If we take the model the initial blogpost was about it's nicely documented: https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...
helloooooooo 4y ago
My new Microsoft Surface Book let’s me switch to 3rd party CAs or even none at all, with no problem. This sounds like a Lenovo issue. On top of that, I would prefer if my machine is by default, in a secure configuration when I buy it. Since the laptops come with Windows pre-installed and Microsoft signed bootloaders, it is fundamentally more secure than if the 3rd parties CAs are enables. I don’t want an attacker chain loading Linux and KVM beneath my Windows OS.
- Arnavion 4y ago
  >I don’t want an attacker chain loading Linux and KVM beneath my Windows OS. If your Windows install was protected by Bitlocker, and the decryption key was stored in the TPM, and the TPM was set up to require attestation to unseal the key, then such chainloading wouldn't be an issue. (This is also explained in the article.) BTW, the default for the firmware interface is that it is not password-protected, so even this particular Lenovo device is vulnerable to the evil maid attack you're describing in its "default secure configuration", because the maid can just toggle that option to enable the UEFI CA, or even disable SB entirely. Unless Lenovo is planning to make the UEFI password a required step in their purchase order process, you can expect that the default configuration is going to be an unprotected UEFI. That's why the way to resolve the threat is not to prevent other bootloaders, but to prevent them from reading the data on disk.
  - tjoff 4y ago
    It is still an issue. A different OS could load and mimic the normal boot procedure to steel any credentials entered. Also, the whole scenario you depict is quite unreasonable to expect of a default install - which is exactly what is being talked about.
    - Arnavion 4y ago
      > It is still an issue. A different OS could load and mimic the normal boot procedure to steel any credentials entered. What credentials? The bitlocker key is in the TPM. It's not something a human can enter. >Also, the whole scenario you depict is quite unreasonable to expect of a default install - which is exactly what is being talked about. I'm confused. Are you referring to the scenario of the Windows install with the bitlocker key in the TPM, or the scenario of the evil maid attack? The former is already how Windows works by default, and the latter is precisely the scenario that helloooooooo was talking about, so I'm not sure which one you're calling unreasonable.
downrightmike 4y ago
The real problem is lately we've been seeing malware that lives in UEFI from APT (Edit: Advanced Persistent Threat actor, usually state sponsored) groups. That means it is persistent and will typically disallow updating the UEFI once infected. And almost everyone hates OS updates, and the smallest percentage are willing to update firmware, because it can brick a device, so UEFI isn't going to get updated. This is one of the few things you MUST trust, even if you want to follow zero trust.
- legalcorrection 4y ago
  >the smallest percentage are willing to update firmware Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.
  - metadat 4y ago
    Sometimes firmware updates make the system worse or even completely bricked. If the machine already working and stable, I've learned it's a risky / bad idea to eagerly apply firmware updates.
    - bayindirh 4y ago
      Flash media is cheap nowadays, and HP EliteBook series laptops store a couple of previous BIOS versions on board to make rollback possible. Also these higher end laptops can try previous version of their firmware if they fail to boot with the latest one. Failing to see how Lenovo can't implement something like that.
      - TheBrokenRail 4y ago
        I know my ThinkPad gives me a "self-healing BIOS" message whenever I update the firmware (on a side note, fwupd is amazing), which according to Lenovo's Twitter is a BIOS backup (https://twitter.com/lenovo/status/1297785406239514624?lang=en https://twitter.com/lenovo/status/1297785406239514624?lang=e...).
mjg59 4y ago
Macs never implemented UEFI Secure Boot. The Apple-specific Secure Boot can be disabled - https://support.apple.com/en-us/HT208198 https://support.apple.com/en-us/HT208198.

Arnavion 4y ago

>I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off. Does it also not let you use your own keys? Because if it does, you don't have to turn SB off, just use your key to sign the UKI and a bootloader like systemd-boot. It should work with any distro, especially one that uses dracut to create the initramfs because it's a couple of lines of dracut config to generate a (signed) UKI instead.

jillesvangurp 4y ago
Not in a way that is obvious to me. I'm sure you can work around it but if you just want to boot a live image and run an installer, ubuntu works and not a whole lot of other distributions do (because their installers don't support secure boot). I assume this is because of how much of a PITA it is to get certified.
- Arnavion 4y ago
  >I assume this is because of how much of a PITA it is to get certified. Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. But yes, it might be that the live CDs don't do that; I don't know. My experience with SB on all my machines has been to start with SB disabled and then I enable it afterwards with my own keys. I know the gparted and OpenSUSE live CDs support SB because I've booted off them after enabling SB. You could boot the Ubuntu live CD (or something smaller like gparted), mount the other distro's live CD, chroot into it, and run the other distro's installer that way. Just be sure that you enable SB support so that the installation actually boots afterwards.
  - AshamedCaptain 4y ago
    > Distros don't have to do anything distro-specific to get signed. Most distros use (Microsoft-signed) shim to chainload to something like grub. You still have to get your own version of shim signed if you want your distro to boot "Scary Boot Prompt"-free. I.e. if you just use RedHat's version of shim, that shim will transparently boot RedHat signed kernels, but refuse to boot SuSE's -- unless you whitelist SuSE's key manually into shim. It's not ideal in any way.
    - Arnavion 4y ago
      I believe for OpenSUSE it uses MokManager to get the user to trust the OpenSUSE CA. But it's been a while since I tried it so I might be misremembering. (MokManager is broken on my mobo so I switched to systemd-boot + my own signing keys, which is better for security anyway.)

Kipters 4y ago

Not disagreeing with the general message, but IMHO if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal. As far as I'm concerned as long as it's possible to re-enable the 3rd Party CA (or disable Secure Boot altogether) it's not tragic considering this only applies to a specific kind of machines ("Secured Core PCs") and not to mainstream ones

jillesvangurp 4y ago
There's a difference between stick in a usb key to fiddle with bios in vendor specific way and then stick a usb key in. It's an extra hurdle. If your instructions read: "turn off secure boot", MS has already won. Some users will, most won't, and many company IT departments would not allow you to on principle (because it's company hardware and they want it secured because it is their problem if it isn't).
- Avamander 4y ago
  > If your instructions read: "turn off secure boot" That's the thing, you don't have to disable that. You just have to re-enable that CA if you have a model that has Device Guard enabled by default. > It's an extra hurdle. Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing.
  - noisy_boy 4y ago
    > Hurdle that doesn't matter at all. If you have the skillset to install an OS, changing a setting in UEFI is nothing. That assertion is a bit too absolute; I am comfortable installing an OS using the USB installer because I have done it many times. I haven't had to change UEFI settings yet and I'm worried that doing something wrong will lock me out (in case of a botched OS install, I can just start over).
    - Avamander 4y ago
      Fair, that fear can be real, but it does sound rare and I think that's what the user manual is for. If we take the model the initial blogpost was about it's nicely documented: https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure_Boot_for_Linux_Secured-core_PCs.pdf https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...

helloooooooo 4y ago

My new Microsoft Surface Book let’s me switch to 3rd party CAs or even none at all, with no problem. This sounds like a Lenovo issue. On top of that, I would prefer if my machine is by default, in a secure configuration when I buy it. Since the laptops come with Windows pre-installed and Microsoft signed bootloaders, it is fundamentally more secure than if the 3rd parties CAs are enables. I don’t want an attacker chain loading Linux and KVM beneath my Windows OS.

Arnavion 4y ago
>I don’t want an attacker chain loading Linux and KVM beneath my Windows OS. If your Windows install was protected by Bitlocker, and the decryption key was stored in the TPM, and the TPM was set up to require attestation to unseal the key, then such chainloading wouldn't be an issue. (This is also explained in the article.) BTW, the default for the firmware interface is that it is not password-protected, so even this particular Lenovo device is vulnerable to the evil maid attack you're describing in its "default secure configuration", because the maid can just toggle that option to enable the UEFI CA, or even disable SB entirely. Unless Lenovo is planning to make the UEFI password a required step in their purchase order process, you can expect that the default configuration is going to be an unprotected UEFI. That's why the way to resolve the threat is not to prevent other bootloaders, but to prevent them from reading the data on disk.
- tjoff 4y ago
  It is still an issue. A different OS could load and mimic the normal boot procedure to steel any credentials entered. Also, the whole scenario you depict is quite unreasonable to expect of a default install - which is exactly what is being talked about.
  - Arnavion 4y ago
    > It is still an issue. A different OS could load and mimic the normal boot procedure to steel any credentials entered. What credentials? The bitlocker key is in the TPM. It's not something a human can enter. >Also, the whole scenario you depict is quite unreasonable to expect of a default install - which is exactly what is being talked about. I'm confused. Are you referring to the scenario of the Windows install with the bitlocker key in the TPM, or the scenario of the evil maid attack? The former is already how Windows works by default, and the latter is precisely the scenario that helloooooooo was talking about, so I'm not sure which one you're calling unreasonable.

downrightmike 4y ago

The real problem is lately we've been seeing malware that lives in UEFI from APT (Edit: Advanced Persistent Threat actor, usually state sponsored) groups. That means it is persistent and will typically disallow updating the UEFI once infected. And almost everyone hates OS updates, and the smallest percentage are willing to update firmware, because it can brick a device, so UEFI isn't going to get updated. This is one of the few things you MUST trust, even if you want to follow zero trust.

legalcorrection 4y ago
>the smallest percentage are willing to update firmware Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.
- metadat 4y ago
  Sometimes firmware updates make the system worse or even completely bricked. If the machine already working and stable, I've learned it's a risky / bad idea to eagerly apply firmware updates.
  - bayindirh 4y ago
    Flash media is cheap nowadays, and HP EliteBook series laptops store a couple of previous BIOS versions on board to make rollback possible. Also these higher end laptops can try previous version of their firmware if they fail to boot with the latest one. Failing to see how Lenovo can't implement something like that.
    - TheBrokenRail 4y ago
      I know my ThinkPad gives me a "self-healing BIOS" message whenever I update the firmware (on a side note, fwupd is amazing), which according to Lenovo's Twitter is a BIOS backup (https://twitter.com/lenovo/status/1297785406239514624?lang=en https://twitter.com/lenovo/status/1297785406239514624?lang=e...).

mjg59 4y ago

Macs never implemented UEFI Secure Boot. The Apple-specific Secure Boot can be disabled - https://support.apple.com/en-us/HT208198 https://support.apple.com/en-us/HT208198.