4 ms·
How strange, shouldn't windows be checking if the binary is signed? Isn't that part of what secureboot and deviceguard do? Or does it just run like any addon?
by spydum 3y ago
How strange, shouldn't windows be checking if the binary is signed? Isn't that part of what secureboot and deviceguard do? Or does it just run like any addon?
- aaronmdjones 3y agoSecure Boot only verifies the NT kernel loader; that in turn will verify that the kernel is signed by Microsoft, and then the kernel will verify any device drivers it loads. Userland (e.g. explorer.exe) is free to be run without any signatures whatsoever; this includes the login screen.
- sim7c00 3y agoits a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot
- mr_mitm 3y agoWe don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater. Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1] Alternatively, patch routines directly in memory [2] [1] https://www.kali.org/tools/chntpw/ https://www.kali.org/tools/chntpw/ [2] https://www.piotrbania.com/all/kon-boot/ https://www.piotrbania.com/all/kon-boot/
- the8472 3y ago> We don't expect Linux to do this, do we? Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).
- wazzaps 3y agoAll androids do it as well
- chromoblob 3y agoNo, only Android from version 4.4 supports Verified Boot, and only Android from version 7.0 strictly enforces it.
- pjmlp 3y agoStill possible, as presented at BlueHat IL 2023, the goal is to eventually have everything signed, based on how UWP sandboxing is working, now extended to Win32 as well. First set of changes already in flight for the next Windows 11 stable release.
- mr_mitm 3y agoWindows Defender started checking for modifications to binaries like utilman.exe or sethc.exe a couple of years ago.
- sim7c00 3y agosecureboot could be leveraged for such things but as with most great features, only the bare minimum implementation is provided in 'modern secure operating systems'