Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

31–40 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#31

Post by iam-TJ »

ab71e5 wrote: post #22

> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…

From the people reporting this affecting their Linux boots in various IRC/Matrix forums and my diagnostics with them, very often they weren't dual-booting in the Microsoft sense, in that they were booting using the UEFI Removable Media Path so there was no entry in the motherboard firmware's Boot menu.

I suspect the MS installer simply scans the EFI BootXXXX entries and looks for a non-Windows boot-loader path like, for example, /EFI/$distro/shimx64.efi

If one-such doesn't exist the installer likely assumes it is not a dual-boot system.

Re: What is an SBAT and why does everyone suddenly care

#32

Post by gruez »

blueflow wrote: post #17
notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

> widespread rootkit level malware and they are trying to stay ahead of the curve Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.

[flagged]

Re: What is an SBAT and why does everyone suddenly care

#33

Post by wyldfire »

blueflow wrote: post #17
notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

> widespread rootkit level malware and they are trying to stay ahead of the curve Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.

[flagged]

Re: What is an SBAT and why does everyone suddenly care

#35

Post by hypeatei »

wyldfire wrote: post #33
blueflow wrote: post #17

Earlier quoted context omitted.

> widespread rootkit level malware and they are trying to stay ahead of the curve Microsoft is within US-legislation. So a three-letter agency already has the keys and their spyware is a signed UEFI module.

[flagged]

I think you underestimate how close big tech and telecom companies are to three letter agencies. See the "Protect America Act" of 2007 which covered everyone's asses for warrantless spying.

Re: What is an SBAT and why does everyone suddenly care

#36

Post by rwmj »

zokier wrote: post #28
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

shim has an EFI variable to control its verbosity, you can set it to output all the gory details with e.g. `mokutil --set-verbosity true`, and on a glance there are some tools on Windows too to modify EFI vars

Why wouldn't that be the default?

Re: What is an SBAT and why does everyone suddenly care

#37

Post by IshKebab »

zokier wrote: post #28
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

shim has an EFI variable to control its verbosity, you can set it to output all the gory details with e.g. `mokutil --set-verbosity true`, and on a glance there are some tools on Windows too to modify EFI vars

Handy for the 7 people in the entire world who a) knew this existed and b) bothered to change it.

(Realistically I expect that's mainly used for debugging purposes for the Shim authors.)

Re: What is an SBAT and why does everyone suddenly care

#38

Post by hypeatei »

> because otherwise they're shipping a vector that can be used to attack other operating systems and that's kind of a violation of the social contract

I see the end of the chain still ends up at "trust" in humans/companies at some level. Microsoft broke dual boot systems because they think they know what's best for someone else's system and that's not okay.

Re: What is an SBAT and why does everyone suddenly care

#40

Post by syene »

zokier wrote: post #19
fmajid wrote: post #15

Earlier quoted context omitted.

Or at least include a URL to a web page explaining the error and what you can do about it

I think Windows BSOD including QR code was pretty clever idea, although unfortunately it's halfbaked in that it's just a fixed generic URL instead of something specific to the error.

The problem with bootloaders is they really can’t spare a lot of storage. Storing different QR codes for all the common errors might be asking too much.
Post reply on HN