5 ms·

I've seen a lot written about the how of SecureBoot but is there a good summary of the why's. I'm still deeply skeptical that this is part of Microsoft's plan t

by avar 14y ago

I've seen a lot written about the how of SecureBoot but is there a good summary of the why's. I'm still deeply skeptical that this is part of Microsoft's plan to eventually transform the PC architecture into something console-like. They've already de-facto achieved that by not mandating that custom OS's can be booted on Windows 8 supporting ARM devices, and between them and pressure from content owners wanting complicit OS's that don't run applications that do things they don't like I can only see that sort of thing progressing in the future.

megaman821 14y ago
I agree that I would like to see custom OS's be bootable on any device, but Microsoft is merely continuing the trend here. Neither Apple nor most Android manufacturers allow ARM devices to boot custom OS's. What is so special about Microsoft that it is an issue when they do it but not the 2+ years other manufacturers have been doing it?
- prosody 14y ago
  I think the general objection is that the instruction set of the CPU isn't salient, rather it's the form factor. The Surface is presented more like a laptop than a tablet, and there are some 3rd party manufacturer Windows 8 ARM laptops in the pipeline.
wmf 14y ago
Ostensibly secure boot exists to foil bootkits (bootloader rootkits) which (in theory) cannot be detected or removed by any antivirus tools. Secure boot also prevents bootloader-based activation hacks (e.g. "Windows Loader") that make it easy to pirate Windows (these hacks can be seen as a special case of "benign" bootkits).
- dmboyd 14y ago
  How prevalent are bootkit (MBR) malicious exploits though? Surely the right place for this is for windows to prevent boot modification without authentication though UAC or something similar?
  - wmf 14y ago
    Secure boot is a form of defense in depth that is really only needed if the kernel is compromised. So yes, the attacks that it prevents are hypothetical and may never exist. And yes, it may be too high a price to pay for the unknown level of protection that it provides.
    - gizmo686 14y ago
      A compromised kernel does not seem that unlikely. I am not fammilar with Windows, but I assume it supports hotloading code into kernel space (like modules in linux), given this, it would be trivial to get from root in userspace to arbitrary code execution in kernel space.
      - wmf 14y ago
        Between driver signing and kernel patch protection, it's harder than you think. But clearly Microsoft is preparing for that sort of compromise.
        gizmo686 14y ago
        If some signed driver is found to have an exploit, is there a mechanism to revoke the signature?
  - ladzoppelin 14y ago
    It already exists. http://www.stoned-vienna.com/ http://www.stoned-vienna.com/ I also read that it was trivial to make a "boot kit" for Windows 8 without secure boot. I actually think it a very big deal and hope many Linux distro's develop something similar.
- rdl 14y ago
  Lack of secure boot also makes it impossible for remote third parties (e.g. netflix, content providers, or enterprise IT departments) to trust client software. Even windows secure boot doesn't provide protection against a targeted attack, but conceivably a combination of EFI secure boot and a bug-free well implemented OS (heh) could provide enough protection for DRM on video content, basic enterprise computing (with non-hostile users), etc. I still think none of this crap really belongs on the client; it is however an awesome fit on the server, which is an area people haven't really explored enough.
  - batgaijin 14y ago
    The DRM for video content just doesn't make sense to me - who is it really for? Will it stop most people? Yes. Will it stop the 0.01% qualified individuals who then share it with everyone else? No!
    - rdl 14y ago
      They will essentially never be able to stop the release groups from releasing stuff, but they can presumably prevent casual ripping by end users, then use the heavy hammer of RICO to go after the groups (DrinkOrDie...). They need to make the value spread between pirate and legit as wide as possible, but rather than making better DRM (to make pirated sw less useful, but also make legit software less useful), IMO they should just focus on making legit software fundamentally more useful when legitimately licensed. I know Steam essentially got me to stop pirating games by integrating their social features, easy library management, etc. Mac App Store sort of does that for most Mac software, too. But there's also the issue of price point -- even if I bought every game I wanted, that's probably <$1000/yr. It's easy to consume >$1000/yr in movies/tv, music, and "internet content", and even easier to pirate, with less value on top of the raw content.
  - shykes 14y ago
    > I still think none of this crap really belongs on the client; it is however an awesome fit on the server, which is an area people haven't really explored enough. Agreed. I remember reading an IBM research paper about combining TPM and virtualization on the server, and getting excited about the possibilities. I wonder what happened to that project. EDIT: found it! http://domino.watson.ibm.com/library/cyberdig.nsf/papers/4427173615992B74852570BC005E7117/$File/rc23778.pdf http://domino.watson.ibm.com/library/cyberdig.nsf/papers/442...

by avar 14y ago

megaman821 14y ago

I agree that I would like to see custom OS's be bootable on any device, but Microsoft is merely continuing the trend here. Neither Apple nor most Android manufacturers allow ARM devices to boot custom OS's. What is so special about Microsoft that it is an issue when they do it but not the 2+ years other manufacturers have been doing it?

prosody 14y ago
I think the general objection is that the instruction set of the CPU isn't salient, rather it's the form factor. The Surface is presented more like a laptop than a tablet, and there are some 3rd party manufacturer Windows 8 ARM laptops in the pipeline.

wmf 14y ago

Ostensibly secure boot exists to foil bootkits (bootloader rootkits) which (in theory) cannot be detected or removed by any antivirus tools. Secure boot also prevents bootloader-based activation hacks (e.g. "Windows Loader") that make it easy to pirate Windows (these hacks can be seen as a special case of "benign" bootkits).

dmboyd 14y ago
How prevalent are bootkit (MBR) malicious exploits though? Surely the right place for this is for windows to prevent boot modification without authentication though UAC or something similar?
- wmf 14y ago
  Secure boot is a form of defense in depth that is really only needed if the kernel is compromised. So yes, the attacks that it prevents are hypothetical and may never exist. And yes, it may be too high a price to pay for the unknown level of protection that it provides.
  - gizmo686 14y ago
    A compromised kernel does not seem that unlikely. I am not fammilar with Windows, but I assume it supports hotloading code into kernel space (like modules in linux), given this, it would be trivial to get from root in userspace to arbitrary code execution in kernel space.
    - wmf 14y ago
      Between driver signing and kernel patch protection, it's harder than you think. But clearly Microsoft is preparing for that sort of compromise.
      - gizmo686 14y ago
        If some signed driver is found to have an exploit, is there a mechanism to revoke the signature?
- ladzoppelin 14y ago
  It already exists. http://www.stoned-vienna.com/ http://www.stoned-vienna.com/ I also read that it was trivial to make a "boot kit" for Windows 8 without secure boot. I actually think it a very big deal and hope many Linux distro's develop something similar.
rdl 14y ago
Lack of secure boot also makes it impossible for remote third parties (e.g. netflix, content providers, or enterprise IT departments) to trust client software. Even windows secure boot doesn't provide protection against a targeted attack, but conceivably a combination of EFI secure boot and a bug-free well implemented OS (heh) could provide enough protection for DRM on video content, basic enterprise computing (with non-hostile users), etc. I still think none of this crap really belongs on the client; it is however an awesome fit on the server, which is an area people haven't really explored enough.
- batgaijin 14y ago
  The DRM for video content just doesn't make sense to me - who is it really for? Will it stop most people? Yes. Will it stop the 0.01% qualified individuals who then share it with everyone else? No!
  - rdl 14y ago
    They will essentially never be able to stop the release groups from releasing stuff, but they can presumably prevent casual ripping by end users, then use the heavy hammer of RICO to go after the groups (DrinkOrDie...). They need to make the value spread between pirate and legit as wide as possible, but rather than making better DRM (to make pirated sw less useful, but also make legit software less useful), IMO they should just focus on making legit software fundamentally more useful when legitimately licensed. I know Steam essentially got me to stop pirating games by integrating their social features, easy library management, etc. Mac App Store sort of does that for most Mac software, too. But there's also the issue of price point -- even if I bought every game I wanted, that's probably <$1000/yr. It's easy to consume >$1000/yr in movies/tv, music, and "internet content", and even easier to pirate, with less value on top of the raw content.
- shykes 14y ago
  > I still think none of this crap really belongs on the client; it is however an awesome fit on the server, which is an area people haven't really explored enough. Agreed. I remember reading an IBM research paper about combining TPM and virtualization on the server, and getting excited about the possibilities. I wonder what happened to that project. EDIT: found it! http://domino.watson.ibm.com/library/cyberdig.nsf/papers/4427173615992B74852570BC005E7117/$File/rc23778.pdf http://domino.watson.ibm.com/library/cyberdig.nsf/papers/442...