8 ms·

SecureBoot and UEFI is a regular pain in my ass. Just yesterday I couldn't run memtest86+ on a new computer because of it. I'm installing a bunch of Linux VMs t

SecureBoot and UEFI is a regular pain in my ass. Just yesterday I couldn't run memtest86+ on a new computer because of it. I'm installing a bunch of Linux VMs these days and both on the real hardware and in the VM images UEFI and SecureBoot is a constant source of stress. And it doesn't even work? Because the firmware authors used crappy code to display marketing images? I want my tens of hours back.

tryauuum 3y ago
at least you can run VMs with traditional boot
jeroenhd 3y ago
Disabling secure boot takes like five seconds, I don't see what the big deal is.
- Lammy 3y ago
  I don’t feel comfortable depending on a vendor to expose that switch. Once all the Secure Boot infrastructure is built out all it will take is one more decision for them to stop giving me an option.
  - sounds 3y ago
    Start installing coreboot then?
    - Lammy 3y ago
      I do use coreboot on my 51nb faux-ThinkPad X210 thanks to @mjg59 :)
  - ok123456 3y ago
    Some cheap laptops have forgotten to expose that switch.
    - okanat 3y ago
      Then they cannot get Windows certification. Microsoft mandates Secure Boot disable setting for all x86 computers.
      - Gazoche 3y ago
        For now.
        growse 3y ago
        Everything in life is only for now.
        account42 3y ago
        Doesn't mean that accepting a situation where all it takes is a policy change is a good idea.
  - fragmede 3y ago
    At which point all hardware that currently exists which you already own will get remotely updated out from under you so you can't boot your own kernel? I get that being allowed to run the code you want on hardware you own is paramount, but let's not live in fear of hypotheticals. There are already secured platforms like the Xbox/PS5/iphone where we don't have that option and the world hasn't ended.
    - zlg_codes 3y ago
      How do you expect the ecosystem to look in 20 years? You're simply not thinking far enough ahead. "it's only a few right now don't worry about it" More happen. "okay maybe I see where you're coming from but it's still avoidable!" It continues. "I still have options I don't know what your problem is." Eventually, no choice. "How did we get here!?!?!" We need protective regulations that ensure that general computing is accessible to every citizen. Giants of industry are not entitled to control devices that they sell after they are sold.
      - fragmede 3y ago
        20 years from now, we're still going to want to run our own software. You're worried about falling down a slippery slope, and your concerns are valid, but it's called the slippery slope fallacy for a reason.
        zlg_codes 3y ago
        I have seen no assurance that the slope is well-gritted. There is a proven inverse correlation between corporate powers and consumer freedoms. It's not fallacious in the slightest, you're simply enjoying the slide for now.
        fragmede 3y ago
        That's your opinion. Smartphones have already brought about the trusted computing only world you fear, for non-technical users. The biggest distinction of general computing then, is the ability to run untrusted executables. Hardware is cheap enough these days that having a secure device dedicated to banking/whatever isn't out of the question. And with Google making virtual machines basically a primitive on Android, having an unlocked system but with trusted VMs inside seems to be the next step in allowing users to have local admistrative access, if they so choose. I don't doubt that ChromeBooks and iPadOS devices will. continue to be popular, but at the very least, there will always be a need for developers to have unrestricted systems to develop on, which, I believe, means that they'll exist until all software ever needed has been written.
- deleted 3y ago
  [deleted]
- NelsonMinar 3y ago
  If your BIOS allows it. Some don't, or if you disable Secure Boot you lose other motherboard features. My home server is an ASUS motherboard that loses Intel integrated graphics without UEFI, which makes installing an OS awkward. https://www.reddit.com/r/ASUS/comments/s68b25/psa_enabling_legacy_boot_aka_compatibility/ https://www.reddit.com/r/ASUS/comments/s68b25/psa_enabling_l... Also like a sucker I thought secure boot was doing something to help secure the boot of my computer and was worth the bother.
  - JoshTriplett 3y ago
    Disabling Secure Boot is not the same as enabling CSM (non-UEFI boot). You can disable Secure Boot while still booting via UEFI without CSM, and that shouldn't affect your graphics at all.
  - gerdesj 3y ago
    "If your BIOS allows it" Which systems enforce Secure Boot out of the box and lose functionality without it? You mention something ASUS and Intel graphics being broken without UEFI which isn't the same thing.
    - Too 3y ago
      Android. After rooting your phone, apps relying on the secure key store and DRM media playback are very likely to stop working.
      - PrimeMcFly 3y ago
        That's nothing to do with Secure Boot though.
        Too 3y ago
        It does. Except they call it verified boot. Maybe rooting was the wrong term, it’s more about installing custom ROM, where this mechanism prevent your custom ROM from getting hold of DRM keys.
- loxias 3y ago
  Even with it disabled sometimes you're still locked into this UEFI mess that I certainly didn't order. I love my thinkpad p1 g3 more than most laptops but I miss having a simple BIOS. Stupid thing can't boot off normal USB keys like I've been making for decades.
  - Isthatablackgsd 3y ago
    You can boot usb from UEFI. The only tool that I found is best to handle is Rufus. I used it to clean install my Windows through UEFI. Even Linux Live USB works. BalenaEtcher gives me problems, Rufus does it well for me. Also I remember there is a setting in UEFI to allow booting from USB.
    - loxias 3y ago
      It's possible, I've done it, it just involved a lot more steps. Simpler when I can `fdisk && mkfs && debootstrap` to make a key. Plus then I need to keep two bootable usb keys, I think... it's just... "Who ordered this??"
  - JoBrad 3y ago
    I’ve never had a problem booting from USB with UEFI.
  - jeroenhd 3y ago
    Strange, I have that laptop model and booting off USB drives works just fine for me (GPT+1 giant FAT32 partition+the UEFI capable ISO just extracted onto the disk). Maybe update the firmware? It could also be some kind of weird compatibility issue with specific USB drives, I wouldn't know. Lenovo also recently released a CVE fix, possibly even for this vulnerability, so you may want to check for firmware updates regardless!
themagician 3y ago
I haven’t done any serious admin work on Windows machines for over a decade. Few weeks ago I went to reinstall Windows on a Dell desktop… I had no idea about SecureBoot. I spent hours trying to figure out what was wrong and learning about SecureBoot and Intel RAID drivers necessary to reinstall Windows.
- luma 3y ago
  SecureBoot isn’t just for windows and it’s a damn nice feature for securing workloads in the datacenter.
  - vaylian 3y ago
    What is the threat model that this protects against?
    - pricci 3y ago
      Someone booting something on your computer without you consent. You can add your own keys and sign the bootloaders of your OSs/LiveCDs/Thumbdrives
  - tryauuum 3y ago
    Do you use it in datacenter? Sounds like a huge investment of time with no reason E.g. if we want to protect from a datacenter employee plugging his usb stick with ubuntu and booting it on our server. We can probably solve it with UEFI with removing default keys and adding them for our OS. (Have never tried it so might be wrong). Also we need to set a BIOS password so that the attacker doesn't simply disable secure boot. This works, but the attacker can just remove BIOS password -- remember, he has physical access. It's for sure harder for him than plugging a usb stick. But if he anyway willing to risk and illegally mess with a customer's server while being monitored with cameras I think he would do it. Something feels off about all of this
    - luma 3y ago
      You’re thinking in terms of encryption, I’m thinking in terms of attestation. Eg, defend against root kits by way of validating all software components in the boot cycle.
fuzzfactor 3y ago
It was clear to see that the purpose of foisting UEFI, TPM, and Microsoft SecureBoot, accompanied by GPT drive partitioning, simultaneously on consumers with the launch of Windows 8.0, was to inhibit the installation and use of alternate operating systems. From that point, new PC buyers would not be able to simply and directly install some other OS other than Windows 8 (or newer Windows) on the PC without four different unfamiliar workarounds, for those four obstacles, which were implemented differently on different motherboards. Even though UEFI was touted as ideal because there were published standards that traditional BIOS never had, we all know in practice that BIOS motherboards were more consistent among vendors and price points than UEFI motherboards anyway. Linux was ominously on the brink of doubling its user share (which still wouldn't have been very significant), but especially it was Windows 7 which was the real threat to adoption of Windows 8. Nothing more, nothing less. As we now see, the touted improvement in "security" was a joke the whole time. Definitely not as secure as a business-class non-UEFI late Windows 7 Professional PC's motherboard. Not like there's any question.
- jarfil 3y ago
  But UEFI can have pretty graphics and mouse support, so it must be better... /s Now seriously, TPM and GPT are improvements. Customizable SecureBoot along with disk and RAM encryption, are also nice.
  - fuzzfactor 3y ago
    I'll agree that you can use TPM and GPT to your advantage, and even SecureBoot can fill an actual need for a small number of PC owners. But with GPT it was strongly recommended by Microsoft as more secure by having no unused sectors on the drive when it is partitioned according to GPT. The unused sectors of a traditional MBR-partitioned drive had been identified as the preferred location of malicious "root-kits" that were capable of executing before the OS even had a chance to boot, were not actually on the Windows partiton and therefore difficult to scan for, and were resistant to reformatting the partition which did not delete the rootkit. To be really sure you got rid of a BIOS/MBR rootkit completely you would have to zero the entire drive, or at least the sectors containing the root kit. Full reinstallation of Windows or even zeroing the entire partition itself didn't help at all. But using GPT there are usually way more unused sectors on the same drive compared to MBR partitioning. Always have been. That's just one of the original lies propagated by Microsoft, endorsing the migration away from a more well-proven traditional BIOS. And here we have a defect in one of the supposedly true security improvements baked into UEFI, with ridiculous false-sense-of-security implications since day zero, now-confirmed and it's exactly a vector for a rootkit no differently than under good old-fashioned BIOS. Except zeroing the entire physical drive still wouldn't get rid of a UEFI rootkit which can now be even more stealthy, enough to reside in the firmware itself. Even at this late date, how many users are scanning their firmware and what apps would they use for that anyway? When truthiness is not a way of life, there can not be actual trust.
anticensor 3y ago
The latest release of memtest86+ can actually run on UEFI computers.

tryauuum 3y ago

at least you can run VMs with traditional boot

jeroenhd 3y ago

Disabling secure boot takes like five seconds, I don't see what the big deal is.

Lammy 3y ago
I don’t feel comfortable depending on a vendor to expose that switch. Once all the Secure Boot infrastructure is built out all it will take is one more decision for them to stop giving me an option.
- sounds 3y ago
  Start installing coreboot then?
  - Lammy 3y ago
    I do use coreboot on my 51nb faux-ThinkPad X210 thanks to @mjg59 :)
- ok123456 3y ago
  Some cheap laptops have forgotten to expose that switch.
  - okanat 3y ago
    Then they cannot get Windows certification. Microsoft mandates Secure Boot disable setting for all x86 computers.
    - Gazoche 3y ago
      For now.
      - growse 3y ago
        Everything in life is only for now.
        account42 3y ago
        Doesn't mean that accepting a situation where all it takes is a policy change is a good idea.
- fragmede 3y ago
  At which point all hardware that currently exists which you already own will get remotely updated out from under you so you can't boot your own kernel? I get that being allowed to run the code you want on hardware you own is paramount, but let's not live in fear of hypotheticals. There are already secured platforms like the Xbox/PS5/iphone where we don't have that option and the world hasn't ended.
  - zlg_codes 3y ago
    How do you expect the ecosystem to look in 20 years? You're simply not thinking far enough ahead. "it's only a few right now don't worry about it" More happen. "okay maybe I see where you're coming from but it's still avoidable!" It continues. "I still have options I don't know what your problem is." Eventually, no choice. "How did we get here!?!?!" We need protective regulations that ensure that general computing is accessible to every citizen. Giants of industry are not entitled to control devices that they sell after they are sold.
    - fragmede 3y ago
      20 years from now, we're still going to want to run our own software. You're worried about falling down a slippery slope, and your concerns are valid, but it's called the slippery slope fallacy for a reason.
      - zlg_codes 3y ago
        I have seen no assurance that the slope is well-gritted. There is a proven inverse correlation between corporate powers and consumer freedoms. It's not fallacious in the slightest, you're simply enjoying the slide for now.
        fragmede 3y ago
        That's your opinion. Smartphones have already brought about the trusted computing only world you fear, for non-technical users. The biggest distinction of general computing then, is the ability to run untrusted executables. Hardware is cheap enough these days that having a secure device dedicated to banking/whatever isn't out of the question. And with Google making virtual machines basically a primitive on Android, having an unlocked system but with trusted VMs inside seems to be the next step in allowing users to have local admistrative access, if they so choose. I don't doubt that ChromeBooks and iPadOS devices will. continue to be popular, but at the very least, there will always be a need for developers to have unrestricted systems to develop on, which, I believe, means that they'll exist until all software ever needed has been written.
deleted 3y ago
[deleted]
NelsonMinar 3y ago
If your BIOS allows it. Some don't, or if you disable Secure Boot you lose other motherboard features. My home server is an ASUS motherboard that loses Intel integrated graphics without UEFI, which makes installing an OS awkward. https://www.reddit.com/r/ASUS/comments/s68b25/psa_enabling_legacy_boot_aka_compatibility/ https://www.reddit.com/r/ASUS/comments/s68b25/psa_enabling_l... Also like a sucker I thought secure boot was doing something to help secure the boot of my computer and was worth the bother.
- JoshTriplett 3y ago
  Disabling Secure Boot is not the same as enabling CSM (non-UEFI boot). You can disable Secure Boot while still booting via UEFI without CSM, and that shouldn't affect your graphics at all.
- gerdesj 3y ago
  "If your BIOS allows it" Which systems enforce Secure Boot out of the box and lose functionality without it? You mention something ASUS and Intel graphics being broken without UEFI which isn't the same thing.
  - Too 3y ago
    Android. After rooting your phone, apps relying on the secure key store and DRM media playback are very likely to stop working.
    - PrimeMcFly 3y ago
      That's nothing to do with Secure Boot though.
      - Too 3y ago
        It does. Except they call it verified boot. Maybe rooting was the wrong term, it’s more about installing custom ROM, where this mechanism prevent your custom ROM from getting hold of DRM keys.
loxias 3y ago
Even with it disabled sometimes you're still locked into this UEFI mess that I certainly didn't order. I love my thinkpad p1 g3 more than most laptops but I miss having a simple BIOS. Stupid thing can't boot off normal USB keys like I've been making for decades.
- Isthatablackgsd 3y ago
  You can boot usb from UEFI. The only tool that I found is best to handle is Rufus. I used it to clean install my Windows through UEFI. Even Linux Live USB works. BalenaEtcher gives me problems, Rufus does it well for me. Also I remember there is a setting in UEFI to allow booting from USB.
  - loxias 3y ago
    It's possible, I've done it, it just involved a lot more steps. Simpler when I can `fdisk && mkfs && debootstrap` to make a key. Plus then I need to keep two bootable usb keys, I think... it's just... "Who ordered this??"
- JoBrad 3y ago
  I’ve never had a problem booting from USB with UEFI.
- jeroenhd 3y ago
  Strange, I have that laptop model and booting off USB drives works just fine for me (GPT+1 giant FAT32 partition+the UEFI capable ISO just extracted onto the disk). Maybe update the firmware? It could also be some kind of weird compatibility issue with specific USB drives, I wouldn't know. Lenovo also recently released a CVE fix, possibly even for this vulnerability, so you may want to check for firmware updates regardless!

themagician 3y ago

I haven’t done any serious admin work on Windows machines for over a decade. Few weeks ago I went to reinstall Windows on a Dell desktop… I had no idea about SecureBoot. I spent hours trying to figure out what was wrong and learning about SecureBoot and Intel RAID drivers necessary to reinstall Windows.

luma 3y ago
SecureBoot isn’t just for windows and it’s a damn nice feature for securing workloads in the datacenter.
- vaylian 3y ago
  What is the threat model that this protects against?
  - pricci 3y ago
    Someone booting something on your computer without you consent. You can add your own keys and sign the bootloaders of your OSs/LiveCDs/Thumbdrives
- tryauuum 3y ago
  Do you use it in datacenter? Sounds like a huge investment of time with no reason E.g. if we want to protect from a datacenter employee plugging his usb stick with ubuntu and booting it on our server. We can probably solve it with UEFI with removing default keys and adding them for our OS. (Have never tried it so might be wrong). Also we need to set a BIOS password so that the attacker doesn't simply disable secure boot. This works, but the attacker can just remove BIOS password -- remember, he has physical access. It's for sure harder for him than plugging a usb stick. But if he anyway willing to risk and illegally mess with a customer's server while being monitored with cameras I think he would do it. Something feels off about all of this
  - luma 3y ago
    You’re thinking in terms of encryption, I’m thinking in terms of attestation. Eg, defend against root kits by way of validating all software components in the boot cycle.

fuzzfactor 3y ago

It was clear to see that the purpose of foisting UEFI, TPM, and Microsoft SecureBoot, accompanied by GPT drive partitioning, simultaneously on consumers with the launch of Windows 8.0, was to inhibit the installation and use of alternate operating systems. From that point, new PC buyers would not be able to simply and directly install some other OS other than Windows 8 (or newer Windows) on the PC without four different unfamiliar workarounds, for those four obstacles, which were implemented differently on different motherboards. Even though UEFI was touted as ideal because there were published standards that traditional BIOS never had, we all know in practice that BIOS motherboards were more consistent among vendors and price points than UEFI motherboards anyway. Linux was ominously on the brink of doubling its user share (which still wouldn't have been very significant), but especially it was Windows 7 which was the real threat to adoption of Windows 8. Nothing more, nothing less. As we now see, the touted improvement in "security" was a joke the whole time. Definitely not as secure as a business-class non-UEFI late Windows 7 Professional PC's motherboard. Not like there's any question.

jarfil 3y ago
But UEFI can have pretty graphics and mouse support, so it must be better... /s Now seriously, TPM and GPT are improvements. Customizable SecureBoot along with disk and RAM encryption, are also nice.
- fuzzfactor 3y ago
  I'll agree that you can use TPM and GPT to your advantage, and even SecureBoot can fill an actual need for a small number of PC owners. But with GPT it was strongly recommended by Microsoft as more secure by having no unused sectors on the drive when it is partitioned according to GPT. The unused sectors of a traditional MBR-partitioned drive had been identified as the preferred location of malicious "root-kits" that were capable of executing before the OS even had a chance to boot, were not actually on the Windows partiton and therefore difficult to scan for, and were resistant to reformatting the partition which did not delete the rootkit. To be really sure you got rid of a BIOS/MBR rootkit completely you would have to zero the entire drive, or at least the sectors containing the root kit. Full reinstallation of Windows or even zeroing the entire partition itself didn't help at all. But using GPT there are usually way more unused sectors on the same drive compared to MBR partitioning. Always have been. That's just one of the original lies propagated by Microsoft, endorsing the migration away from a more well-proven traditional BIOS. And here we have a defect in one of the supposedly true security improvements baked into UEFI, with ridiculous false-sense-of-security implications since day zero, now-confirmed and it's exactly a vector for a rootkit no differently than under good old-fashioned BIOS. Except zeroing the entire physical drive still wouldn't get rid of a UEFI rootkit which can now be even more stealthy, enough to reside in the firmware itself. Even at this late date, how many users are scanning their firmware and what apps would they use for that anyway? When truthiness is not a way of life, there can not be actual trust.

anticensor 3y ago

The latest release of memtest86+ can actually run on UEFI computers.