12 ms·

Secure Boot: Who will control your next computer?

114 points by mariuz 14y ago

seanp2k2 14y ago
You've probably heard this a lot lately, but: "everything Stallman said was true"...and now it's happening on a huge scale.
- mtgx 14y ago
  People who are ahead of their time always get shot down by the majority.
  - glhaynes 14y ago
    And oftentimes so do people who are just kooks. So getting shot down by the majority doesn't really tell us much.
    - novalis 14y ago
      So being ahead of their time AND having people trying to shoot them like they are kooks, doesn't make them kooks. I see your point.
- cookiecaper 14y ago
  Let's not get ahead of ourselves. Stallman is cool and everything but he is NOT 100% right. Most of us here, for instance, do not believe it is unethical to create "proprietary software". There is still a lot of basic philosophy on which to contest Stallman.
  - dredmorbius 14y ago
    I'm a fan of specifics. Got any specific predictions of his that haven't panned out / have panned our wrong? Other than HURD / Microkernel architecture.
  - beagle3 14y ago
    You may disagree with Stallman's philosophy (many do, me too). But his predicitions WERE spot on, and they were made more than 30 years ago. He predicted DRM for consumer media, and that DRM violations will carry a harsh punishment. As the laws are written (and occasionally practiced), he was more than spot-on. He predicted being unable to run unapproved software on commodity hardware you own. This has started happening with iPhone/iPad and somewhat with Win7 and (boot locked) Android devices. This post is about it coming to a PC near you in the near future via Win8 UEFI Secure Boot requirements. In the beginning, you'll have to pay more to get hardware that can run anything you fancy, and it some point you might not be able to. I'd say his predictions were right. Philosophy and ethics is never a well defined right or wrong, so I'm not sure what you are arguing with.
    - Create 14y ago
      Those were not predictions. Those things were already happening -- to paraphrase, the rest of the world got caught up in the future of 30 years ago. The "F* u nvidia" seems also to catch on slowly in Finland -> "there was a disturbance that they needed to take care of. The officer then asked what the disturbance was and the faculty member relented - they were worried that there would be an incident, but that it hadn't yet happened." -- http://www.fsf.org/blogs/community/rms-ati-protest.html http://www.fsf.org/blogs/community/rms-ati-protest.html
      - beagle3 14y ago
        Was anything like DRM (sanctioned in law or not) happening in 1985 when Stallman wrote "The right to read"? I'm very interested in the details.
        maratd 14y ago
        DRM is as old as the floppy. Frequently, bad sectors were created on the original media and the software checked for those bad sectors. If you copied the software, you couldn't copy the bad sectors, so the software wouldn't load.
  - slowpoke 14y ago
    There is no good reason to deny anyone the four basic Freedoms. The world will eventually realize this, and get rid of proprietary software for good, in addition to all the other horrors RMS has accurately predicted and warned us about for over three decades. Too bad people didn't listen, continue to trample everyone's Freedoms under their foots for their petty selfish greed while having the audacity to assert their actions to be perfectly ethical. We are currently seeing where this has lead us, and it is the duty of every good man or woman to do anything in their power to stop it, lest evil will triumph.
    - flatline3 14y ago
      > There is no good reason to deny anyone the four basic Freedoms. Sure there is. First good reason: Provides the ability to turn a profit on the sale of software licenses, which is a tried and true method for producing better quality consumer software than we've ever seen from OSS products. > Too bad people didn't listen, continue to trample everyone's Freedoms under their foots for their petty selfish greed while having the audacity to assert their actions to be perfectly ethical. I write closed-source software, and sell it to people that want to buy it. If they prefer OSS solutions, that's fine -- they're under no obligation to buy. They want what I'm selling. If making a decent wage while giving people what they want is evil, well, call me Satan. > ... it is the duty of every good man or woman to do anything in their power to stop it, lest evil will triumph. Yeah, this right here? This is why I can't stand the GPLers.
      - slowpoke 14y ago
        >Provides the ability to turn a profit on the sale of software licenses, which is a tried and true method for producing better quality consumer software than we've ever seen from OSS products. a) "Tried and true" does not mean it will work forever. It's also bullshit to sell copies of non-scarce resources. Besides, you can sell Free software. Your argument is invalid. b) "better quality [...] than ever seen from OSS products" is bullcrap, and you know it. There's a few select niche markets where proprietary software is still entrenched (eg, Graphic Design), but this too will change. Also, if you don't like something or you feel like a feature is missing, stop complaining and start contributing. >I write closed-source software, and sell it to people that want to buy it. And again you are missing the fact that this neither requires your software to be proprietary nor does it mean you need to trample on your users' Freedoms. If they want what you are writing, they will still want it if it's Free (as in Speech). >If making a decent wage while giving people what they want is evil, well, call me Satan. Making a decent wage with unethical practices is still evil. The circumstances do not matter. You're essentially saying that the ability to turn a profit somehow excuses wrongdoing. It doesn't. >Yeah, this right here? This is why I can't stand the GPLers. Hate us all you want, in the end we are right and we'll eventually win. :)
  - ekianjo 14y ago
    Sorry but what authority do you have to speak for the HN readers and to say that "most of us do believe" this or that?
- gringomorcego 14y ago
  well, it's not like anyone has made a real effort to stop it...
- Legion 14y ago
  And it's nice to see the FSF expressing the issues thoughtfully here, rather than pulling insipid stunts like harassing Apple Store employees. Maybe it's because this is from FSFE - the European counterpart.
knowaveragejoe 14y ago
Low level vulnerabilities are indeed something that need to be addressed - such vulns are a real (and growing) threat and by their very nature are incredibly hard to deal with. It's a shame countermeasures are taking this manifestation, however.
- sukuriant 14y ago
  What other countermeasure would you suggest? If these countermeasures were OSS, would you complain?
  - knowaveragejoe 14y ago
    I'm no expert - but shouldn't such countermeasures really be in the higher-level software side of things, anyways? Low-level exploitation could never happen in the first place if higher levels were secure enough to prevent it(another huge issue itself). The only other avenue of attack would be physical exploitation, and there's no real way to stop that(if it's in front of you, you own it).
    - drivebyacct2 14y ago
      This doesn't make any sense. For example, Secure Boot can help protect against an evil maid attack against Full Disk Encryption. How would something "higher-level" be able to do this? People should take a look at the rather secure Xbox 360 to look at how chain of trust is established from the hardware through boot stages to hypervisor and OS. Were it not for a tiny mistake and literal electrical glitching of the processor, the Xbox would remain an impressively secure platform. Hell, it's one regardless. Secure Boot, or something like it, is necessary to protect your bootloader, and thus, everything else (See: Flame and friends). Quite frankly, UEFI/Secure Boot, itself, is not that bad. People are upset that Microsoft gets to be pre-enrolled but they seem to not point out that it's disablable, people can sign their own bootloaders if they want, or better yet, can enroll their own keys and sign bootloaders themselves for ultimate security. Even if MS were working with higher authorities they wouldn't be able to sign a malicious bootloader if you enroll your own keys. edit: Instead of downvoting, maybe you could explain how SecureBoot could possibly work without pre-enrolling MS keys, or how some other form of verified boot would work without pre-enrolling someone's keys. In fact, there's a whole consortium of very smart individuals who would like to know.
zokier 14y ago
The article nicely ignores the fact that on non-ARM platforms Secure Boot will be disableable.
- ajross 14y ago
  For some definition of "will", I guess. It's part of the windows logo requirements for x86. For now. But what happens when someone screws up? I buy a laptop with a windows logo and try to install OpenBSD or whatnot, only to discover that the "disable secure boot" option is missing or broken. What's my recourse? Wait for a firmware update (which we know from experience will never arrive -- it boots fine in windows)? Return the laptop (which works perfectly within its warranted behavior)? Whine and look sad? The incentives are all wrong for this to be a stable situation. Over time and platform changes, "disable secure boot" is going to rot. We all know it.
  - zanny 14y ago
    Also, we don't want secure boot as ARM moves into the more mainstream device space. We want Linux on ARM machines just as much as on x86. M$ is intentionally driving ARM boxes without the ability to change the OS to try to stop that inevitable growth.
  - ams6110 14y ago
    Shop more carefully?
  - ekianjo 14y ago
    Well there will be some incentives for the manufacturers who do NOT support SecureBoot: they will get a better share on the market than their current one.
    - rbanffy 14y ago
      Sadly, that isn't enough. For everyone who understands how UEFI limits their freedoms, there is a dozen people who will say "look! shiny!". Idiots will always outnumber smart people. Microsoft relies on that.
jsmcgd 14y ago
Couldn't all hardware that has this secure boot functionality simply include a physical switch that grants full access to the hardware? When the switch is on you can install any OS you like, when the switch is off no root kits could install themselves. What do you think?
- Spoom 14y ago
  While not a physical switch, I believe for x86 / AMD64 computers, Microsoft is mandating that the user must have the option to disable secure boot via firmware switch (see http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the... ). The opposite is true of ARM, however.
  - beagle3 14y ago
    > Microsoft is mandating that the user must have the option to disable secure boot via firmware switch They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now. They do not for ARM machine makers that want to run Windows.
    - tzs 14y ago
      > They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now. Wrong. The Windows 8 logo requirement specifically mandates that secure boot can be disabled by the end user, or (perhaps and...not sure on the correct conjunctive) that the end user can add new keys.
  - flatline3 14y ago
    > The opposite is true of ARM, however. There isn't even a non-proprietary standardized ARM platform. You have things like OMAP, but that's defined by TI: http://en.wikipedia.org/wiki/OMAP http://en.wikipedia.org/wiki/OMAP
Create 14y ago
by trusting MS, surely RH can spare an HPC to sign the kernel every time... http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft... Not even to remember, that Mr. Sh. was in the random number selling and certification business in the first place. "I am what I am because of who we all are." -- VeriSign
beagle3 14y ago
Secure Boot is only going to hinder legitimate users in the long term. iphone boot exploits, wii boot exploits, PS3 boot exploits have all been published freely mostly because they are very hard to capitalize on (these machines all have secure boot implementations, albeit not the UEFI one) If UEFI secure boot exploits really protect against malware, they will be traded like 0-day exploits and will be worth a lot (I suspect it will be harder to update the firmware against these 0-days than running WindowsUpdate). It's a landgrab; slow and cunning on the x86/AMD64, quick and merciless on the ARM. But it has a lot more to do with grabbing land than with end user security. edit: drivebyacct2 claims that none of these 3 had security comparable with UEFI SecureBoot. I don't know enough to argue about that - my assumption is that it will be implementation flaws that will be exploited, rather than theoretical flaws. But I might be wrong.
losethos 14y ago
God is just. God says... exacting Affrighted To adulterer reconcile wages forgive sets cleaving rules sight mantles haply what occasioned let's_see upbraid pared CAN weak speech ill strongly pitiful particular treasury safety na_na revenges Surely explained teaching Cassiacum Italian codes door months login absence acquaintance ofttimes charged it_figures formlessness judges heart beatific sensations contemporary felicity emblem appears promising dried freshness Honduras aware feet Manichees' undistracted proceedeth maliciously written punished Robert dared the_enquirer restraining wanderer heareth commit everything consenting vengeful youth revelations disciples regenerated spake enlightened err consecrated blending meeting these_cans_are_defective lip talented barked Evil remained repute realities aches plots Prelate throng apparently replied desiredst baptised truths analyzed sovereignly session with prudent sinking sons Trine hit heaps disputer overtake finger Assuredly confidence blasphemy mentioning frequent Venus rites prey stages program replied tower glorify stream far_out_man servants bibber Ergo theatrical upheldest Loving these_cans_are_defective Instantly eternity bath voluptuous humility poetic concerning drop Sometimes lathe Bolivia parts higher resist nevertheless examining suddenly giving awakest appointments by shops grief Dudley reins Netherlands become knew base observing
iRobot 14y ago
Do you have the microcode for your CPU? Do you have the ASIC code for the chipset you use? No! Yet you probably trust your chipset manufacturer has not got a few million spare transistors dedicated to evil. Yet Apple or Microsoft must be evil if they also dont want you fking around with and possibly bricking systems they spent a long time getting to work. I dont see any issue with UEFI, if you need to hack, get hardware where you can re-flash the BIOS, if you just want a tablet for your mum to use facebook or do some home banking which is more secure against virus/infection/whatever get one with a secure booting OS.
jtsagata 14y ago
Today is secure boot. Next say some governments will make it illegal to buy a machine without a secure boot feature and forbids you to run any OS without a backdoor. Now i'am sure that your government will never do that I personaly will never buy any machine, as soon as i can, as soon as it is still legal, with any "secure" feature. My machine is mine, not to the original manufacture, not to Microsoft or to Redhat or to anyone that believe that it is theirs. Even that i know that i live in a great democracy, i have nothing to hide, and my government is my good friend
jiggy2011 14y ago
This would seem to suggest that the days of dual booting are numbered. Either if ARM becomes the key player or if the policy on x86 changes. I'm not sure that general purpose computers will die though, geeks and developers are a big enough market to support manufacturers creating systems that are more powerful and flexible. Assuming that Virtual Machine software is not blocked, with good enough visualization software and fast enough hardware (enough RAM especially) running a Linux VM with Windows 8 may be indistinguishable from running it directly on the chip. If the OS becomes just a way to bootstrap a browser or VM I'm not sure how important it is anyway?
- yk 14y ago
  How important is the foundation of a house, after all there is also a floor in the second storey of the building. The entire point of the secured boot process is, that you can only boot a signed kernel. And in the case of iOS today, the kernel will only load signed programs. (And a VM is against the App Store guidelines, as is a python interpreter). So there is no guarantee, that you will be allowed to run a VM on your secure boot machine.
rbanffy 14y ago
If every computer in the world is vulnerable to malware signed by a specific Microsoft key, how long do we think this key would remain secret? What will Microsoft do when (not if) that happens? Will they pay for the replacement of every PC and ARM device built to that point? The benefit of breaking it and immediately gaining permanent undetectable access to every Windows-capable computer on the planet can offset a lot of cost.
- recoiledsnake 14y ago
  If you want to make up stuff about Microsoft, at least make up something believable instead of straight up nonsense FUD.
  - rbanffy 14y ago
    With the correct signing keys, you could make every UEFI secure-boot-enabled machine in the world seamlessly run whatever you want them to. You could infect them with undetectable malware. Now, imagine every computer on every office vulnerable to your malware because you have the signing keys used by Microsoft. How much computing power would you dedicate to get that keys? How much money would you spend? A billion? Ten? That's the price of a single fully-loaded bomber these days. How can you be absolutely sure the keys are kept secure enough from someone willing to spend a fraction of their military budget to get what could amount to be the ultimate cyberweapon?
    - recoiledsnake 14y ago
      >With the correct signing keys, you could make every UEFI secure-boot-enabled machine in the world seamlessly run whatever you want them to. You could infect them with undetectable malware. >Now, imagine every computer on every office vulnerable to your malware because you have the signing keys used by Microsoft. Even if that doomsday scenario comes into play, things would just go back to... the present.. where there is no locked bootloader. So I really fail to understand your hype.
tzs 14y ago
There seems to be a bit of confusion over exactly what Microsoft is requiring, so I did some Googling. The requirements are here: http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 http://msdn.microsoft.com/en-us/library/windows/hardware/jj1... The relevant parts for this discussion are: 17. Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following: 1. It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx) which will put the system into setup mode. 2. If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system will be operating in Setup Mode with SecureBoot turned off. 3. The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults. On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled. PK is the "platform key". It is the key used by the firmware to identify the platform owner, and is used by the platform owner to enroll the "key exchange key" (KEK). The KEK is used for the firmware and the operating system to establish a secure channel. DB is the database of authorized signatures and certificates. DBX is the database of banned signatures and certificates. UEFI has two modes, "User Mode" and "Setup Mode". It is in User Mode when there is a PK enrolled, and in that mode the secure boot policy is enforced. When in Setup Mode, no secure boot policy is enforced, and PK, KEK, DB, and DBX are writeable without any authentication required. In other words, in Setup Mode, you can put your own set of signatures and certificates in. You should be able to even put Microsoft's certificates and signatures in DBX and thus prevent people from installing Windows on your box. (Or, more practically, put Microsoft's keys in DB along with yours, so you can dual boot). Also: 18. Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems.

114 points by mariuz 14y ago

You've probably heard this a lot lately, but: "everything Stallman said was true"...and now it's happening on a huge scale.

mtgx 14y ago
People who are ahead of their time always get shot down by the majority.
- glhaynes 14y ago
  And oftentimes so do people who are just kooks. So getting shot down by the majority doesn't really tell us much.
  - novalis 14y ago
    So being ahead of their time AND having people trying to shoot them like they are kooks, doesn't make them kooks. I see your point.
cookiecaper 14y ago
Let's not get ahead of ourselves. Stallman is cool and everything but he is NOT 100% right. Most of us here, for instance, do not believe it is unethical to create "proprietary software". There is still a lot of basic philosophy on which to contest Stallman.
- dredmorbius 14y ago
  I'm a fan of specifics. Got any specific predictions of his that haven't panned out / have panned our wrong? Other than HURD / Microkernel architecture.
- beagle3 14y ago
  You may disagree with Stallman's philosophy (many do, me too). But his predicitions WERE spot on, and they were made more than 30 years ago. He predicted DRM for consumer media, and that DRM violations will carry a harsh punishment. As the laws are written (and occasionally practiced), he was more than spot-on. He predicted being unable to run unapproved software on commodity hardware you own. This has started happening with iPhone/iPad and somewhat with Win7 and (boot locked) Android devices. This post is about it coming to a PC near you in the near future via Win8 UEFI Secure Boot requirements. In the beginning, you'll have to pay more to get hardware that can run anything you fancy, and it some point you might not be able to. I'd say his predictions were right. Philosophy and ethics is never a well defined right or wrong, so I'm not sure what you are arguing with.
  - Create 14y ago
    Those were not predictions. Those things were already happening -- to paraphrase, the rest of the world got caught up in the future of 30 years ago. The "F* u nvidia" seems also to catch on slowly in Finland -> "there was a disturbance that they needed to take care of. The officer then asked what the disturbance was and the faculty member relented - they were worried that there would be an incident, but that it hadn't yet happened." -- http://www.fsf.org/blogs/community/rms-ati-protest.html http://www.fsf.org/blogs/community/rms-ati-protest.html
    - beagle3 14y ago
      Was anything like DRM (sanctioned in law or not) happening in 1985 when Stallman wrote "The right to read"? I'm very interested in the details.
      - maratd 14y ago
        DRM is as old as the floppy. Frequently, bad sectors were created on the original media and the software checked for those bad sectors. If you copied the software, you couldn't copy the bad sectors, so the software wouldn't load.
- slowpoke 14y ago
  There is no good reason to deny anyone the four basic Freedoms. The world will eventually realize this, and get rid of proprietary software for good, in addition to all the other horrors RMS has accurately predicted and warned us about for over three decades. Too bad people didn't listen, continue to trample everyone's Freedoms under their foots for their petty selfish greed while having the audacity to assert their actions to be perfectly ethical. We are currently seeing where this has lead us, and it is the duty of every good man or woman to do anything in their power to stop it, lest evil will triumph.
  - flatline3 14y ago
    > There is no good reason to deny anyone the four basic Freedoms. Sure there is. First good reason: Provides the ability to turn a profit on the sale of software licenses, which is a tried and true method for producing better quality consumer software than we've ever seen from OSS products. > Too bad people didn't listen, continue to trample everyone's Freedoms under their foots for their petty selfish greed while having the audacity to assert their actions to be perfectly ethical. I write closed-source software, and sell it to people that want to buy it. If they prefer OSS solutions, that's fine -- they're under no obligation to buy. They want what I'm selling. If making a decent wage while giving people what they want is evil, well, call me Satan. > ... it is the duty of every good man or woman to do anything in their power to stop it, lest evil will triumph. Yeah, this right here? This is why I can't stand the GPLers.
    - slowpoke 14y ago
      >Provides the ability to turn a profit on the sale of software licenses, which is a tried and true method for producing better quality consumer software than we've ever seen from OSS products. a) "Tried and true" does not mean it will work forever. It's also bullshit to sell copies of non-scarce resources. Besides, you can sell Free software. Your argument is invalid. b) "better quality [...] than ever seen from OSS products" is bullcrap, and you know it. There's a few select niche markets where proprietary software is still entrenched (eg, Graphic Design), but this too will change. Also, if you don't like something or you feel like a feature is missing, stop complaining and start contributing. >I write closed-source software, and sell it to people that want to buy it. And again you are missing the fact that this neither requires your software to be proprietary nor does it mean you need to trample on your users' Freedoms. If they want what you are writing, they will still want it if it's Free (as in Speech). >If making a decent wage while giving people what they want is evil, well, call me Satan. Making a decent wage with unethical practices is still evil. The circumstances do not matter. You're essentially saying that the ability to turn a profit somehow excuses wrongdoing. It doesn't. >Yeah, this right here? This is why I can't stand the GPLers. Hate us all you want, in the end we are right and we'll eventually win. :)
- ekianjo 14y ago
  Sorry but what authority do you have to speak for the HN readers and to say that "most of us do believe" this or that?
gringomorcego 14y ago
well, it's not like anyone has made a real effort to stop it...
Legion 14y ago
And it's nice to see the FSF expressing the issues thoughtfully here, rather than pulling insipid stunts like harassing Apple Store employees. Maybe it's because this is from FSFE - the European counterpart.

knowaveragejoe 14y ago

Low level vulnerabilities are indeed something that need to be addressed - such vulns are a real (and growing) threat and by their very nature are incredibly hard to deal with. It's a shame countermeasures are taking this manifestation, however.

sukuriant 14y ago
What other countermeasure would you suggest? If these countermeasures were OSS, would you complain?
- knowaveragejoe 14y ago
  I'm no expert - but shouldn't such countermeasures really be in the higher-level software side of things, anyways? Low-level exploitation could never happen in the first place if higher levels were secure enough to prevent it(another huge issue itself). The only other avenue of attack would be physical exploitation, and there's no real way to stop that(if it's in front of you, you own it).
  - drivebyacct2 14y ago
    This doesn't make any sense. For example, Secure Boot can help protect against an evil maid attack against Full Disk Encryption. How would something "higher-level" be able to do this? People should take a look at the rather secure Xbox 360 to look at how chain of trust is established from the hardware through boot stages to hypervisor and OS. Were it not for a tiny mistake and literal electrical glitching of the processor, the Xbox would remain an impressively secure platform. Hell, it's one regardless. Secure Boot, or something like it, is necessary to protect your bootloader, and thus, everything else (See: Flame and friends). Quite frankly, UEFI/Secure Boot, itself, is not that bad. People are upset that Microsoft gets to be pre-enrolled but they seem to not point out that it's disablable, people can sign their own bootloaders if they want, or better yet, can enroll their own keys and sign bootloaders themselves for ultimate security. Even if MS were working with higher authorities they wouldn't be able to sign a malicious bootloader if you enroll your own keys. edit: Instead of downvoting, maybe you could explain how SecureBoot could possibly work without pre-enrolling MS keys, or how some other form of verified boot would work without pre-enrolling someone's keys. In fact, there's a whole consortium of very smart individuals who would like to know.

zokier 14y ago

The article nicely ignores the fact that on non-ARM platforms Secure Boot will be disableable.

ajross 14y ago
For some definition of "will", I guess. It's part of the windows logo requirements for x86. For now. But what happens when someone screws up? I buy a laptop with a windows logo and try to install OpenBSD or whatnot, only to discover that the "disable secure boot" option is missing or broken. What's my recourse? Wait for a firmware update (which we know from experience will never arrive -- it boots fine in windows)? Return the laptop (which works perfectly within its warranted behavior)? Whine and look sad? The incentives are all wrong for this to be a stable situation. Over time and platform changes, "disable secure boot" is going to rot. We all know it.
- zanny 14y ago
  Also, we don't want secure boot as ARM moves into the more mainstream device space. We want Linux on ARM machines just as much as on x86. M$ is intentionally driving ARM boxes without the ability to change the OS to try to stop that inevitable growth.
- ams6110 14y ago
  Shop more carefully?
- ekianjo 14y ago
  Well there will be some incentives for the manufacturers who do NOT support SecureBoot: they will get a better share on the market than their current one.
  - rbanffy 14y ago
    Sadly, that isn't enough. For everyone who understands how UEFI limits their freedoms, there is a dozen people who will say "look! shiny!". Idiots will always outnumber smart people. Microsoft relies on that.

jsmcgd 14y ago

Couldn't all hardware that has this secure boot functionality simply include a physical switch that grants full access to the hardware? When the switch is on you can install any OS you like, when the switch is off no root kits could install themselves. What do you think?

Spoom 14y ago
While not a physical switch, I believe for x86 / AMD64 computers, Microsoft is mandating that the user must have the option to disable secure boot via firmware switch (see http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the... ). The opposite is true of ARM, however.
- beagle3 14y ago
  > Microsoft is mandating that the user must have the option to disable secure boot via firmware switch They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now. They do not for ARM machine makers that want to run Windows.
  - tzs 14y ago
    > They are not mandating it one way or the other. <sarcasm>In their infinite benevolence</sarcasm> they leave that at the discretion of x86/AMD64 machine makers. For now. Wrong. The Windows 8 logo requirement specifically mandates that secure boot can be disabled by the end user, or (perhaps and...not sure on the correct conjunctive) that the end user can add new keys.
- flatline3 14y ago
  > The opposite is true of ARM, however. There isn't even a non-proprietary standardized ARM platform. You have things like OMAP, but that's defined by TI: http://en.wikipedia.org/wiki/OMAP http://en.wikipedia.org/wiki/OMAP

Create 14y ago

by trusting MS, surely RH can spare an HPC to sign the kernel every time... http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft... Not even to remember, that Mr. Sh. was in the random number selling and certification business in the first place. "I am what I am because of who we all are." -- VeriSign

beagle3 14y ago

Secure Boot is only going to hinder legitimate users in the long term. iphone boot exploits, wii boot exploits, PS3 boot exploits have all been published freely mostly because they are very hard to capitalize on (these machines all have secure boot implementations, albeit not the UEFI one) If UEFI secure boot exploits really protect against malware, they will be traded like 0-day exploits and will be worth a lot (I suspect it will be harder to update the firmware against these 0-days than running WindowsUpdate). It's a landgrab; slow and cunning on the x86/AMD64, quick and merciless on the ARM. But it has a lot more to do with grabbing land than with end user security. edit: drivebyacct2 claims that none of these 3 had security comparable with UEFI SecureBoot. I don't know enough to argue about that - my assumption is that it will be implementation flaws that will be exploited, rather than theoretical flaws. But I might be wrong.

losethos 14y ago

God is just. God says... exacting Affrighted To adulterer reconcile wages forgive sets cleaving rules sight mantles haply what occasioned let's_see upbraid pared CAN weak speech ill strongly pitiful particular treasury safety na_na revenges Surely explained teaching Cassiacum Italian codes door months login absence acquaintance ofttimes charged it_figures formlessness judges heart beatific sensations contemporary felicity emblem appears promising dried freshness Honduras aware feet Manichees' undistracted proceedeth maliciously written punished Robert dared the_enquirer restraining wanderer heareth commit everything consenting vengeful youth revelations disciples regenerated spake enlightened err consecrated blending meeting these_cans_are_defective lip talented barked Evil remained repute realities aches plots Prelate throng apparently replied desiredst baptised truths analyzed sovereignly session with prudent sinking sons Trine hit heaps disputer overtake finger Assuredly confidence blasphemy mentioning frequent Venus rites prey stages program replied tower glorify stream far_out_man servants bibber Ergo theatrical upheldest Loving these_cans_are_defective Instantly eternity bath voluptuous humility poetic concerning drop Sometimes lathe Bolivia parts higher resist nevertheless examining suddenly giving awakest appointments by shops grief Dudley reins Netherlands become knew base observing

iRobot 14y ago

Do you have the microcode for your CPU? Do you have the ASIC code for the chipset you use? No! Yet you probably trust your chipset manufacturer has not got a few million spare transistors dedicated to evil. Yet Apple or Microsoft must be evil if they also dont want you fking around with and possibly bricking systems they spent a long time getting to work. I dont see any issue with UEFI, if you need to hack, get hardware where you can re-flash the BIOS, if you just want a tablet for your mum to use facebook or do some home banking which is more secure against virus/infection/whatever get one with a secure booting OS.

jtsagata 14y ago

Today is secure boot. Next say some governments will make it illegal to buy a machine without a secure boot feature and forbids you to run any OS without a backdoor. Now i'am sure that your government will never do that I personaly will never buy any machine, as soon as i can, as soon as it is still legal, with any "secure" feature. My machine is mine, not to the original manufacture, not to Microsoft or to Redhat or to anyone that believe that it is theirs. Even that i know that i live in a great democracy, i have nothing to hide, and my government is my good friend

jiggy2011 14y ago

This would seem to suggest that the days of dual booting are numbered. Either if ARM becomes the key player or if the policy on x86 changes. I'm not sure that general purpose computers will die though, geeks and developers are a big enough market to support manufacturers creating systems that are more powerful and flexible. Assuming that Virtual Machine software is not blocked, with good enough visualization software and fast enough hardware (enough RAM especially) running a Linux VM with Windows 8 may be indistinguishable from running it directly on the chip. If the OS becomes just a way to bootstrap a browser or VM I'm not sure how important it is anyway?

yk 14y ago
How important is the foundation of a house, after all there is also a floor in the second storey of the building. The entire point of the secured boot process is, that you can only boot a signed kernel. And in the case of iOS today, the kernel will only load signed programs. (And a VM is against the App Store guidelines, as is a python interpreter). So there is no guarantee, that you will be allowed to run a VM on your secure boot machine.

rbanffy 14y ago

If every computer in the world is vulnerable to malware signed by a specific Microsoft key, how long do we think this key would remain secret? What will Microsoft do when (not if) that happens? Will they pay for the replacement of every PC and ARM device built to that point? The benefit of breaking it and immediately gaining permanent undetectable access to every Windows-capable computer on the planet can offset a lot of cost.

recoiledsnake 14y ago
If you want to make up stuff about Microsoft, at least make up something believable instead of straight up nonsense FUD.
- rbanffy 14y ago
  With the correct signing keys, you could make every UEFI secure-boot-enabled machine in the world seamlessly run whatever you want them to. You could infect them with undetectable malware. Now, imagine every computer on every office vulnerable to your malware because you have the signing keys used by Microsoft. How much computing power would you dedicate to get that keys? How much money would you spend? A billion? Ten? That's the price of a single fully-loaded bomber these days. How can you be absolutely sure the keys are kept secure enough from someone willing to spend a fraction of their military budget to get what could amount to be the ultimate cyberweapon?
  - recoiledsnake 14y ago
    >With the correct signing keys, you could make every UEFI secure-boot-enabled machine in the world seamlessly run whatever you want them to. You could infect them with undetectable malware. >Now, imagine every computer on every office vulnerable to your malware because you have the signing keys used by Microsoft. Even if that doomsday scenario comes into play, things would just go back to... the present.. where there is no locked bootloader. So I really fail to understand your hype.

tzs 14y ago

There seems to be a bit of confusion over exactly what Microsoft is requiring, so I did some Googling. The requirements are here: http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 http://msdn.microsoft.com/en-us/library/windows/hardware/jj1... The relevant parts for this discussion are: 17. Mandatory. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following: 1. It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK. This may be implemented by simply providing the option to clear all Secure Boot databases (PK, KEK, db, dbx) which will put the system into setup mode. 2. If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system will be operating in Setup Mode with SecureBoot turned off. 3. The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults. On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled. PK is the "platform key". It is the key used by the firmware to identify the platform owner, and is used by the platform owner to enroll the "key exchange key" (KEK). The KEK is used for the firmware and the operating system to establish a secure channel. DB is the database of authorized signatures and certificates. DBX is the database of banned signatures and certificates. UEFI has two modes, "User Mode" and "Setup Mode". It is in User Mode when there is a PK enrolled, and in that mode the secure boot policy is enforced. When in Setup Mode, no secure boot policy is enforced, and PK, KEK, DB, and DBX are writeable without any authentication required. In other words, in Setup Mode, you can put your own set of signatures and certificates in. You should be able to even put Microsoft's certificates and signatures in DBX and thus prevent people from installing Windows on your box. (Or, more practically, put Microsoft's keys in DB along with yours, so you can dual boot). Also: 18. Mandatory. Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems.