7 ms·

It's amazing. I read the first 3 paragraphs and the eff can't even acknowledge how much of a problem malware is for many computer users. For the thousandth ti

• cletus 14y ago
  I've had similar thoughts. I can make a fairly strong case that the best platform for me to access sensitive information from is iOS (specifically my iPad). It's sandboxed and comparatively secure. Using Windows these days just seems like asking for trouble on the spyware/malware front. Some of it is your machine getting owned, other times its just missing a checkbox on a program install that installs a browser bar that does God knows what. My Macbook Air is pretty much my computer of choice these days (with very little third party software). Soon Apple will require sandboxing on the Mac App Store too. Linux of course also being a much better choice than Windows from a security point of view. On the browser front I can't see myself using anything other than Chrome. Part of this is feature-related and the whole one process per tab thing but it's also the most security-conscious browser IMHO (disclaimer: I work for Google but not on Chrome).
  • gouranga 14y ago
    We've got 135 on site users, 25 mobile users and about 500 windows machines and VMs floating around. We haven't had any machines "owned" at all...
    • simonbrown 14y ago
      As far as you know.
      • rdl 14y ago
        Well managed and secured Windows 7 is actually probably more secure than any other major desktop OS right now (iOS blows it out of the water of course). OSX is more secure out of the box for a single user deployment perhaps (largely due to being less of a target), but in a corporate environment, it's harder to really lock down OSX than anything else. Sadly.
        • gouranga 14y ago
          Indeed. Our security police means that we have to put our iOS and Macs on the DMZ rather than internal network.
      • gouranga 14y ago
        Oh believe me, we know.
        • anextio 14y ago
          Famous last words. Sorry, but a basic principle of security is to assume that you are already 'owned'.
          • gouranga 14y ago
            Actually no, that's part of risk assessment i.e reactive security. A better basic principle is guard all your doors, windows (excuse the pun) and cracks religiously (proactive).
• Xuzz 14y ago
  The FSF, not the EFF. The EFF is generally much more reasonable (moderate?) about things like this; the FSF is generally more in line with Stallman's views (radical or crazy, depending if you agree with him).
  • rbanffy 14y ago
    You know... They fight for the users. Exchanging long-term freedom for short-term security (or the illusion of security) is rarely a good idea.
    • einhverfr 14y ago
      I still see the FSF as a bit... idk... zealous? delusional? deliberately blind? The basic problem is that the GPL cannot live up to it's goal in all cases unless it is backed by both a) software patents and b) a software patent license under the terms of the GPL. Absent that all you have is a license that allows you to do some things otherwise prohibited by copyright law. You have no restrictions beyond copyright law. The problem here is that copyright law doesn't ban all copying and distribution. Notable cases in the US which allowed verbatim copying of part of source or object code in commercial products as fair use include Oracle v. Google and Lexmark v. SCC. In both cases the court basically said that 17 USC 102(b) precludes using copyrights to ban control secondary markets of practical tools. So I read this as that in US law you do not need the copyright owner's permission to distribute software that links to a copyrighted library. If I want to link to GNU Readline with my proprietary app, 17 USC 102(b) protects me regarding US law, provided I dont distribute Readline myself. But hey, virtually every Linux distro ships with Readline so, what does it matter? I don't know how fruits-of-labor jurisdictions address this issue but there is likely to be some line that prevents this as well. Otherwise Microsoft could say "Nobody can distribute MinGW for Windows 8 because no longer give permission to link against our system libraries for that version." No court in the world will give Microsoft that level of power, ergo I doubt the FSF has anything close to that either.
      • rbanffy 14y ago
        The GPL was designed to protect users, not developers. Under it, developers can't hide the source code from their users, can't prevent their users from modifying the programs they use and from helping other users with the code they have. If you statically link to a GPL'ed library, your code is GPL'ed, end of story. What Lexmark did was to use code as an excuse to prevent the formation of a free market. What Lexmark did is very close to what Microsoft is trying to do preventing the formation of a free market for operating systems for ARM devices.
• viraptor 14y ago
  How much of that malware is actually working at the level that the bootloader is concerned with? And how many samples are just trivial keyloggers, screen grabbers, enablers for fishing attacks, etc. that don't even need anything more than user-level privileges? I'd happily run a system with no standard antivirus / malware protection / ... as long as it has a good separation of resources from kernel to user-space. I subscribe to ideas like http://qubes-os.org http://qubes-os.org much more than trying to protect the bootloader. The typical user-space is exposed too much at the moment and the number of really sophisticated exploits isn't that big. You're saying "Microsoft is at least trying to do this" about a company that continues to hold up fixes to known exploits (maybe not publicly known, but it takes only a single person...) until a convenient patch day, but manages to push own idea of security which breaks other peoples' systems onto the whole industry (strangely those other systems are not affected to the same degree). That's what I would call a very real concern. From my experience with the "typical user", migrating my gf's laptop from Windows to Ubuntu did more for security than any bootloader hardening could do. And it required no hardware update either...
  • anonymfus 14y ago
    >And how many samples are just trivial keyloggers, screen grabbers, enablers for fishing attacks, etc. that don't even need anything more than user-level privileges? They need more privileges for hiding itself from antivirus software, SmartScreen and MMSRT.
    • viraptor 14y ago
      That's true. Unfortunately that assumes the user 1. has an antivirus installed 2. his interaction with it isn't limited to closing the "license expired" window as quickly as possible at startup. That's still a very typical pattern.
      • recoiledsnake 14y ago
        Windows 8 will come with MSE functionality pre-installed.
      • deleted 14y ago
• beagle3 14y ago
  Unless you can produce credible statistics showing bootloader malware, I'm going to call "strawman". Bootloader signing is going to do NOTHING against the current threat model, which is all in the much higher levels. Yes, an ios-app-store for all apps model IS effective against the current threat model (but also harmful to the computing economy at large). Secure boot, at this point, does ESSENTIALLY NOTHING against any of the worms / trojans out there.
  • recoiledsnake 14y ago
    Here are some references about boot malware which UEFI secure boot can prevent. http://www.chmag.in/article/sep2011/rootkits-are-back-boot-infection http://www.chmag.in/article/sep2011/rootkits-are-back-boot-i... http://www.theregister.co.uk/2010/11/16/tdl_rootkit_does_64_bit_windows/ http://www.theregister.co.uk/2010/11/16/tdl_rootkit_does_64_... http://www.computerworld.com/s/article/9217953/Rootkit_infection_requires_Windows_reinstall_says_Microsoft http://www.computerworld.com/s/article/9217953/Rootkit_infec... I recommend reading atleast the first link. Here's one juicy bit: TDL4 is the most recent high tech and widely spread member of the TDSS family rootkit, targeting x64 operating systems too such as Windows Vista and Windows 7. One of the most striking features of TDL4 is that it is able to load its kernel-mode driver on systems with an enforced kernel-mode code signing policy (64-bit versions of Microsoft Windows Vista and 7) and perform kernel-mode hooks with kernel-mode patch protection policy enabled. When the driver is loaded into kernel-mode address space it overwrites the MBR (Master Boot Record) of the disk by sending SRB (SCSI Request Block) packets directly to the miniport device object, then it initializes its hidden file system. The bootkit’s modules are written into the hidden file system from the dropper. The TDL4 bootkit controls two areas of the hard drive one is the MBR and other is the hidden file system created at the time of malware deployment. When any application reads the MBR, the bootkit changes data and returns the contents of the clean MBR i.e. prior to the infection, and also it takes care of Infected MBR by protecting it from overwriting. The hidden file system with the malicious components also gets protected by the bootkit. So if any application is making an attempt to read sectors of the hard disk where the hidden file system is stored, It will return zeroed buffer instead of the original data. The bootkit contains code that performs additional checks to prevent the malware from the cleanup. At every start of the system TDL4 bootkit driver gets loaded and initialized properly by performing tasks as follows: Reads the contents of the boot sector, compares it with the infected image stored in hidden file system, if it finds any difference between these two images it rewrites the infected image to the boot sector. Sets the DriverObject field of the miniport device object to point to the bootkit’s driver object and also hooks the DriverStartIo field of the miniport’s driver object. If kernel debugging is enabled then this TDL4 does not install any of it’s components. TDL4 Rootkit hooks the ATAPI driver i.e. standard windows miniport drivers like atapi.sys. It keeps Device Object at lowest in the device stack, which makes a lot harder to dump TDL4 files. All these striking features have made TDL4 most notorious Windows rootkit and it is also very important to mention that the key to its success is the boot sector infection. Another bit: The original MBR and driver component are stored in encrypted form using the same encryption. Driver component hooks ATAPI's DriverStartIo routine where it monitors for write operations. In case of write operation targeted at the MBR sector, it is changed to read operation. This way it is trying to bypass repair operation by Security Products.
• keithpeter 14y ago
  "I know a computer user who almost had a $300k sum stolen because his laptop was owned." Was this unfortunate gentleman's laptop subject to unauthorised access by means of a compromised bootloader/bios? I have heard of very few exploits of that nature (but I'm not involved in supporting large numbers of machines).
  • cooldeal 14y ago
    The concern is not that bootloaders/bios is compromised. It is that once the PC is compromised, the malware can load from the bootloader before the OS or antivirus can even load, and then hide itself from them completely, thus making it effectively invisible. Think of it like a VM loader, an OS running in a VM may not even be able to find out if it's running on Linux or Windows, but the host can transparently see everything going on in the guest OS.
  • einhverfr 14y ago
    I am no fan of what Microsoft is doing here, but it is an emerging threat profile and consequently some sort of boot loader signing makes sense. The exact design of course should be such that it is possible for users to update keys, however, because otherwise, once a key is compromised the whole system falls apart.
• batgaijin 14y ago
  Until we have 'personality' virtualization for os's, so you can have subaccounts, the model is shitty. Also, programs and users should be treated the same.
  • einhverfr 14y ago
    Isn't that, more or less, what selinux lets you do?
• mjg59 14y ago
  Well maybe you should have read more of it? They explicitly acknowledge the benefits of secure boot - the concern they have is that it's possible for the current model to be used to prevent the owners of machines from being able to choose what their computer will run.
• ajross 14y ago
  This is the Free Software Foundation's position, not the Electronic Frontier Foundation's. Those are very different organizations. The fact that you confuse their acronyms (and also that you apparently stopped reading after three paragraphs) makes me worried that you are conflating their positions. Also: how does secure boot prevent your laptop from being "owned?". It doesn't. I will bet a significant fraction of that $300k that the exploit used against your friend was not pre-OS malware.
  • ibotty 14y ago
    a fraction as in 1, i'd say.
• cooldeal 14y ago
  Not only that, but after calling secure boot basically useless for security, they turn around and want to secure their PCs against malware known as Windows using secure boot!
  • Flimm 14y ago
    They didn't call it useless, they said it could be useful, if done correctly. From their point of view, if it were done correctly, the user ought to be able to block Windows. But since that will be difficult, it undermines the security advantages of Secure Boot. Their position is quite consistent.
• giZm0 14y ago
  >I know a computer user who almost had a $300k sum stolen because his laptop was owned. He has had to resort to having a second laptop used exclusively for accessing his business bank accounts in order to feel some security. He's not dumb: he makes more money than virtually anybody reading this and has an undergrad in math. So what you saying is that just because you know some smart guy that owns a lot of money, UEFI is a good solution for fighting malware. I'm not so sure that UEFI is really gone help your friend to be more secure ... maby feel more secure though, which of course is a valid point but probably not because he will see thru it. Maby you friends laptop was due to a bootloader hack but there is easier ways to hack computer then that. I'm not saying that we shouldn't try to do anything about the risks but not this way, because this do only do it harder for everyone else.
• stcredzero 14y ago
  > The computer security model for most users is incredibly broken. Agreed. > The alternate to secure boot is something like an ios app store for all apps. That's not the only alternative, though. Having a way to simply notify users of a signing status change would be enough. http://news.ycombinator.com/item?id=4190930 http://news.ycombinator.com/item?id=4190930
• rbanffy 14y ago
  > It's amazing. I read the first 3 paragraphs and the eff can't even acknowledge how much of a problem malware is for many computer users. Maybe because those who boot into environments endorsed by the FSF don't have a malware problem. I certainly don't. That doesn't make me insensitive to other people's problems. But I have no sympathy for those who face such problems because they chose to. I'll take it seriously when bootloader malware become the dominant model, because only difference is being harder to detect. Each and every malware I've seen is perfectly happy with user-level permissions and privilege escalation from within the OS and, once UEFI becomes the norm, I suspect signing keys will leak anyway.
• wtallis 14y ago
  "can't even acknowledge how much of a problem malware is for many computer users" What text are you drawing that conclusion from? It strikes me that they deliberately pass up the opportunity to disparage the security explanation for secure boot: "This claim ignores the fact that we need protection from them." Not "This claim is total BS." The FSF statement acknowledges the security concern and brings up a competing concern. They ask that computer makers balance the two competing needs, and state that the plans for implementing secure boot on x86 will satisfy both needs. That's definitely not the blindly one-sided position you seem to think it is.