4 ms·

> Given the association with the secured-core requirements, this is presumably a security decision of some kind. Unfortunately, we have no real idea what this s

> Given the association with the secured-core requirements, this is presumably a security decision of some kind. Unfortunately, we have no real idea what this security decision is intended to protect against. Isn't secure boot attempting to protect against 'evil maid' attacks? After all, the evil maid can come in on Day 1 and insert a bootable USB stick which boots a linux distro customised to look like the normal Windows boot and save your password when you enter it; then on Day 2 boot the computer normally and use that password. If you want to protect against that, you need password-protected BIOS settings to enable/disable booting third-party code. (Personally I see adopting the TPM as a fool's errand - I don't think it can ever deliver on its promises)

phh 4y ago
If you can't modify victim's computer itself, just do that on another computer? The evil maid will need less time to replace the computer with another one that looks alike the original one, than to install a Linux distro
- dotancohen 4y ago
  The maid could even install a USB keylogger, if the goal is compromising just the credentials.
  - michaelt 4y ago
    This is what I mean when I say adopting the TPM is a fool's errand; I think protection against evil maid attacks is impossible. Unless you're willing to go full iphone/xbox with no third-party hardware or OSes.
    - phh 4y ago
      In the case of the Xbox, you can replace the mainboard with like a rpi and still achieve it quite easily (I'd say budget ~ 100€). That's harder for a smartphone (I'd say budget ~ 2000€). Either way, the budget is still lower than the price of security flaws to circumvent secure boot.
    - AshamedCaptain 4y ago
      > Unless you're willing to go full iphone/xbox with no third-party hardware or OSes And even then, you still have the entire 1st party OS attack surface to play with. Which is just _huge_ specially considering this evil maid scenario implies you have a large amount of time with full control of the device itself and all its hardware. These evil maid scenarios are so academical in nature by now, that there is practically no way to defend against them outside academia itself.
      - judge2020 4y ago
        Presumably, if you can't touch the bootloader & the device has BitLocker enabled, then you can't even get into the OS unless you either (A) know the user's password, or (B) have an exploit that can be triggered from the lock screen.
        marcosdumay 4y ago
        You are saying that down in a thread about how it's much easier to just switch the entire computer...
323 4y ago
The standard response is that after entering the password the user will notice that the boot fails to complete to the expected Windows instance. In a high security environment this boot failure should immediately be flagged and investigated and the machine considered compromised.
- michaelt 4y ago
  Just chuck up a screen saying "Configuring update for Windows, do not turn off your PC" and reboot 2 minutes later. There's now no evidence of compromise except a user saying "My computer rebooted unexpectedly, there was a message about windows update" - hardly something that's going to set alarm bells ringing.
  - 323 4y ago
    Any failure to get to the expected desktop must be investigated. No exceptions. If you ignore red flags, yeah, you are going to get owned. Windows doesn't do that normally, it doesn't reboot after installing updates during the boot. It can only happen if the computer crashes during update install, which again, is rare and a red flag. So it's not like every week you will need to send your computer to investigations during update installs. But of course, the evil maid can just implant your keyboard.
    - phendrenad2 4y ago
      What if the USB Linux stick loads the NTFS partition and runs the entire Windows OS inside of HyperV? Are users supposed to learn VM escape shellcode to check their PC each time? ("You fat-fingered your shellcode? Well you deserve to be owned!")
      - 323 4y ago
        The TPM machine check would fail in that case and the TPM would refuse to provide the crypto keys to decrypt the copied NTFS partition. That's the whole purpose of SecureBoot, to detect hardware/software changes (including HyperV).
phendrenad2 4y ago
Yes, it's likely to stop evil maid attacks. But keylogging is just one attack vector. If you can boot to Linux, you can clone a copy of the user's data, to be decrypted with a cluster off-site.

phh 4y ago

If you can't modify victim's computer itself, just do that on another computer? The evil maid will need less time to replace the computer with another one that looks alike the original one, than to install a Linux distro

dotancohen 4y ago
The maid could even install a USB keylogger, if the goal is compromising just the credentials.
- michaelt 4y ago
  This is what I mean when I say adopting the TPM is a fool's errand; I think protection against evil maid attacks is impossible. Unless you're willing to go full iphone/xbox with no third-party hardware or OSes.
  - phh 4y ago
    In the case of the Xbox, you can replace the mainboard with like a rpi and still achieve it quite easily (I'd say budget ~ 100€). That's harder for a smartphone (I'd say budget ~ 2000€). Either way, the budget is still lower than the price of security flaws to circumvent secure boot.
  - AshamedCaptain 4y ago
    > Unless you're willing to go full iphone/xbox with no third-party hardware or OSes And even then, you still have the entire 1st party OS attack surface to play with. Which is just _huge_ specially considering this evil maid scenario implies you have a large amount of time with full control of the device itself and all its hardware. These evil maid scenarios are so academical in nature by now, that there is practically no way to defend against them outside academia itself.
    - judge2020 4y ago
      Presumably, if you can't touch the bootloader & the device has BitLocker enabled, then you can't even get into the OS unless you either (A) know the user's password, or (B) have an exploit that can be triggered from the lock screen.
      - marcosdumay 4y ago
        You are saying that down in a thread about how it's much easier to just switch the entire computer...

323 4y ago

The standard response is that after entering the password the user will notice that the boot fails to complete to the expected Windows instance. In a high security environment this boot failure should immediately be flagged and investigated and the machine considered compromised.

michaelt 4y ago
Just chuck up a screen saying "Configuring update for Windows, do not turn off your PC" and reboot 2 minutes later. There's now no evidence of compromise except a user saying "My computer rebooted unexpectedly, there was a message about windows update" - hardly something that's going to set alarm bells ringing.
- 323 4y ago
  Any failure to get to the expected desktop must be investigated. No exceptions. If you ignore red flags, yeah, you are going to get owned. Windows doesn't do that normally, it doesn't reboot after installing updates during the boot. It can only happen if the computer crashes during update install, which again, is rare and a red flag. So it's not like every week you will need to send your computer to investigations during update installs. But of course, the evil maid can just implant your keyboard.
  - phendrenad2 4y ago
    What if the USB Linux stick loads the NTFS partition and runs the entire Windows OS inside of HyperV? Are users supposed to learn VM escape shellcode to check their PC each time? ("You fat-fingered your shellcode? Well you deserve to be owned!")
    - 323 4y ago
      The TPM machine check would fail in that case and the TPM would refuse to provide the crypto keys to decrypt the copied NTFS partition. That's the whole purpose of SecureBoot, to detect hardware/software changes (including HyperV).

phendrenad2 4y ago

Yes, it's likely to stop evil maid attacks. But keylogging is just one attack vector. If you can boot to Linux, you can clone a copy of the user's data, to be decrypted with a cluster off-site.