3 ms·
its a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept u
by sim7c00 3y ago
its a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot
- mr_mitm 3y agoWe don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater. Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1] Alternatively, patch routines directly in memory [2] [1] https://www.kali.org/tools/chntpw/ https://www.kali.org/tools/chntpw/ [2] https://www.piotrbania.com/all/kon-boot/ https://www.piotrbania.com/all/kon-boot/
- the8472 3y ago> We don't expect Linux to do this, do we? Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).
- wazzaps 3y agoAll androids do it as well
- chromoblob 3y agoNo, only Android from version 4.4 supports Verified Boot, and only Android from version 7.0 strictly enforces it.