Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

101–110 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#101

Post by dathinab »

teekert wrote: post #58

A recent Linux Unplugged episode went into how one can use the TPM to set up a secure and trusted chain of trust for the booting process on Linux [0] using Clevis [1], very interesting! [0] https://linuxunplugged.com/572 [1] https://fedoramagazine.org/automatically-decrypt-your-disk-u...

I do something similar on all my laptops:

- have custom secure boot platform key

- use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition)

- sign the image with that platform key (I use sbctrl)

- have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long password. TPM2+password would be optimal. There had been too many cases of leaky TPMs and especially on a laptop you don't want to fully rely on it (through you in turn could decide to auto login if PCRs are unchanged, or login using only the (often not so secure) fingerprint reader etc.)

- efi password, I mean if you don't set that you lose most secure boot benefits... EDIT: Not really most, there is still a bunch of ways it helps but it's anyway a bad idea to rely on secure boot and not have a efi password

As bonus tip:

- include the vfat in your initramfs (i.e. `MODULES=(vfat)` in `/etc/mkinitcpio.conf`) if your booting kernel and installed kernel modules ever mismatch that is nice to have to fix the issue

Re: What is an SBAT and why does everyone suddenly care

#102

Post by eightysixfour »

skywhopper wrote: post #71
eightysixfour wrote: post #59

Earlier quoted context omitted.

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows? Exactly how would you propose starting software securely from an unknown environment? > Back when all this was being introduced I felt that (a) secure boot increases the risk…

> Exactly how would you propose starting software securely from an unknown environment? Accept that it’s impossible?

Okay, so then you need to know the environment, which leads us to secure boot. It isn't perfect, but it is better than nothing.

Re: What is an SBAT and why does everyone suddenly care

#103

Post by marcosdumay »

MatthiasDev wrote: post #98
candiddevmike wrote: post #87

Earlier quoted context omitted.

Why would an agency wanting to MITM you publish data about the MITM certificates?

Because browsers can require certificates to be in the certificate transparency logs to be valid. Chrome already does this. If a government convinces a CA to create a malicious certificate and publishes this cert to the CT logs to perform MITM, it will get found out and that CA can close its doors.

How does the MITM victim get a non-MITM connection to the CT logs so they can be sure to get the correct ones?

Re: What is an SBAT and why does everyone suddenly care

#104

Post by detourdog »

gcr wrote: post #12
detourdog wrote: post #10

Earlier quoted context omitted.

The last time I had to manages windows I used Unattended to wipe and re-install to a base level. I found that diagnosing and troubleshooting was not worth the effort. https://tgup.net/

How does tgup compare to ninite? The latter seems more polished and older/stable, with more software available. https://ninite.com/

no idea. This was the early 2000s. I'm sure it's based on the same thing. I set-up a netbsd box as the server and could hook up as many laptop as I had network ports. I would then just hit the enter key or perform a few manually steps when things couldn't be automated.

I'm sure it's all based on silent install or the /s switch for install.bat. If my memory is working.

Re: What is an SBAT and why does everyone suddenly care

#105

Post by kccqzy »

rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

I hate error messages from most software. Recently my system failed to boot because systemd told me a start job is running for a certain disk. And it doesn't tell me what the nature of the start job is, why the start job is needed, and why the start job is not finishing. From the disk UUID I could guess the first two, but there was no way to guess the third.

Re: What is an SBAT and why does everyone suddenly care

#106

Post by imchillyb »

rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

If security vendors followed this logic then all an attacker would have to do is look up the error and render the security moot.

By leaving the reason vague an attacker has no immediate feedback and no clue how to remedy.

I vastly prefer the way this works now.

Re: What is an SBAT and why does everyone suddenly care

#107

Post by antonkochubey »

syene wrote: post #40
zokier wrote: post #19

Earlier quoted context omitted.

I think Windows BSOD including QR code was pretty clever idea, although unfortunately it's halfbaked in that it's just a fixed generic URL instead of something specific to the error.

The problem with bootloaders is they really can’t spare a lot of storage. Storing different QR codes for all the common errors might be asking too much.

Currently EFI partitions are on the order of 300-500 MB for common installs, that'd allow you to store millions of PNG-compressed QR codes.

Or even better, a small library which'd allow bootloader to generate it on the fly.

Re: What is an SBAT and why does everyone suddenly care

#108

Post by dist-epoch »

marcosdumay wrote: post #103
MatthiasDev wrote: post #98

Earlier quoted context omitted.

Because browsers can require certificates to be in the certificate transparency logs to be valid. Chrome already does this. If a government convinces a CA to create a malicious certificate and publishes this cert to the CT logs to perform MITM, it will get found out and that CA can close its doors.

How does the MITM victim get a non-MITM connection to the CT logs so they can be sure to get the correct ones?

By using pinned certificates which are hardcoded into all the major browsers.

Re: What is an SBAT and why does everyone suddenly care

#109

Post by vengefulduck »

marcosdumay wrote: post #103
MatthiasDev wrote: post #98

Earlier quoted context omitted.

Because browsers can require certificates to be in the certificate transparency logs to be valid. Chrome already does this. If a government convinces a CA to create a malicious certificate and publishes this cert to the CT logs to perform MITM, it will get found out and that CA can close its doors.

How does the MITM victim get a non-MITM connection to the CT logs so they can be sure to get the correct ones?

Browsers enforce that certificates are signed by two independent CT logs. The public keys of which is shipped by the browser. So a MITM would need to compromise a trusted CA and two CT logs to be able to pull off an attack undetected. Maybe not impossible but much more difficult than just a single CA compromise.

Re: What is an SBAT and why does everyone suddenly care

#110

Post by dist-epoch »

9dev wrote: post #45
wyldfire wrote: post #33

Earlier quoted context omitted.

[flagged]

Oh, you mean like the time Microsoft was the first company in the Prism program uncovered by Snowden, later followed by Yahoo, Google, Facebook, YouTube, Skype, AOL, and Apple? The program allowing the NSA to decrypt any traffic* or data of these vendors? The publication of which had, like, no consequences for Microsoft or the others? Yeah. I don't think they're really afraid of repeating that.

Those exact Snowden documents detailed how Microsoft refused to backdoor Bitlocker despite major pressure from the NSA.
Post reply on HN