3 ms·

Sure, it modifies Windows. But if it modifies the Windows bootloader, Windows refuses to boot. If it modifies the Windows kernel, the bootloader refuses to load

• emidln 14y ago
  So you exploit the kernel (or some driver), do whatever evil shit you want, then lie to the signed malware checker. You now have an APT that ignores this whole notion of secure boot. Come to think of it, this is every modern rootkit. You try to remove it and it reinstalls itself. There's not intrinsic reason why you have to modify the kernel that sits on disc. Now there are lots of other checks and features you can add (that already exist) to make it harder to get access to the kernel, to make sure that unknown objects are purged or flagged on reboot, etc. The thing is, this secure boot doesn't seem to significantly make your machine more secure than current TPM-based methods involving sealing a hard disk decryption key that is only unlocked based on checksums of firmware, nvram, bootloader, kernel, etc.
  • mjg59 14y ago
    No, there's no intrinsic reason why you have to modify the on-disk kernel. It just makes detection more difficult, because there's never a point where the OS is running without having been compromised. That makes detection much harder. You're right that this is no more secure than using a TPM. But most consumer-grade hardware has no TPM, and hardware vendors aren't going to add one just for Microsoft.