What is an SBAT and why does everyone suddenly care • Hacker News Board

Re: What is an SBAT and why does everyone suddenly care

#111

Post by 9dev » Thu, Aug 22, 2024, 3:15 PM UTC

duped wrote: post #76

9dev wrote: post #54

Earlier quoted context omitted.

This is really bad advice—don't follow it. Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly. Running critical software without updating may have been possible in some distant past, but it isn't any longer: You will catch an exploit or crypto locker at some point. Microsoft abusing its update mechanism to pushing crap is nothing new, but downright refusing u…

> Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly. And yet, Windows updates are a bigger threat to me than malware.

[flagged]

Re: What is an SBAT and why does everyone suddenly care

#112

Post by warkdarrior » Thu, Aug 22, 2024, 3:15 PM UTC

skywhopper wrote: post #71

eightysixfour wrote: post #59

Earlier quoted context omitted.

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows? Exactly how would you propose starting software securely from an unknown environment? > Back when all this was being introduced I felt that (a) secure boot increases the risk…

> Exactly how would you propose starting software securely from an unknown environment? Accept that it’s impossible?

Giving up is certainly an option, but it is not the preferred option for some people (myself included). A partial option is definitely better than giving up, as long as it is well understood.

In this scenario, people who are ready to give up can simply stop updating their software, which will solve their issue. YMMV of course.

Re: What is an SBAT and why does everyone suddenly care

#113

Post by dist-epoch » Thu, Aug 22, 2024, 3:18 PM UTC

skywhopper wrote: post #67

Interesting. The question that immediately popped into my head was: How does the secure boot system determine the “security generation” of GRUB exactly? Sounds like just based on the assertion of GRUB itself (and trusted signature of the distribution that built GRUB)? The fact that the list of allowed GRUB versions is itself manageable via a Windows Update points to some other issues with this particular security sch…

It goes the other way too. An Ubuntu Update could put the Windows bootloader on the deny list.

Re: What is an SBAT and why does everyone suddenly care

#114

Post by kccqzy » Thu, Aug 22, 2024, 3:24 PM UTC

xnzakg wrote: post #7

rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

This is why I strongly prefer working on software made by developers for developers. That is to say, internal tooling. You can just show the entire error message in as much detail as possible, without a PM stepping in and saying you can't show this much scary text to the typical user. Especially if the user of the software also has easy access to your source code so they can search for the exact string and find the exact location of the error, and understand exactly what checks are being done to emit that error.

Re: What is an SBAT and why does everyone suddenly care

#115

Post by mixmastamyk » Thu, Aug 22, 2024, 3:27 PM UTC

dathinab wrote: post #101

teekert wrote: post #58

A recent Linux Unplugged episode went into how one can use the TPM to set up a secure and trusted chain of trust for the booting process on Linux [0] using Clevis [1], very interesting! [0] https://linuxunplugged.com/572 [1] https://fedoramagazine.org/automatically-decrypt-your-disk-u...

I do something similar on all my laptops: - have custom secure boot platform key - use a unified kernel image (UKI) which means I directly boot the kernel from efi (and place it in the efi partition) - sign the image with that platform key (I use sbctrl) - have every thing else including swap partition for hybernation fully disk encrypted, I could set it up to auto unlock using TPM2 but I would recommend using a long…

What are the details with a custom key?

Re: What is an SBAT and why does everyone suddenly care

#116

Post by moffkalast » Thu, Aug 22, 2024, 3:34 PM UTC

9dev wrote: post #64

moffkalast wrote: post #57

Earlier quoted context omitted.

When a windows update destroys your install, is it really any different from actual malware? I consider it one and protect myself accordingly. At least you can be careful about the rest with adblocking, sandboxing and being irrelevant enough to not make your machine a target for anyone competent, which gives you a pretty great chance at avoiding them. If you keep built-in malware (and in recent versions, also spyware…

> At least you can be careful about the rest with adblocking, sandboxing and being irrelevant enough to not make your machine a target for anyone competent, which gives you a pretty great chance at avoiding them. That maybe used to be a thing, but isn't anymore really: There only needs to be a single, unpatched vulnerability in your network stack, the multitude of devices around you, whether at home, work, or in a ca…

Yeah all it takes for to drop dead is a single blood vessel bursting in one's head, one careless driver, one wrong thing eaten, one wrong step and you fall and break your neck.

It's always one unlikely thing. I don't think living in such paranoia is a life worth living tbh. Some small risks you just accept to live normally, and 99.9% of the time it'll be alright. With 2FA and other multi device safeguards the risk is acceptable. Frankly authentication for things has gotten so bloated that even the actual user has a hard time logging into things these days.

Frankly I'm more worried about losing or damaging my phone, if that happens then I'm far more screwed and it's a risk we all accept every day. I keep it in aluminium armour to de-risk :)

Re: What is an SBAT and why does everyone suddenly care

#117

Post by mixmastamyk » Thu, Aug 22, 2024, 3:37 PM UTC

dist-epoch wrote: post #110

9dev wrote: post #45

Earlier quoted context omitted.

Oh, you mean like the time Microsoft was the first company in the Prism program uncovered by Snowden, later followed by Yahoo, Google, Facebook, YouTube, Skype, AOL, and Apple? The program allowing the NSA to decrypt any traffic* or data of these vendors? The publication of which had, like, no consequences for Microsoft or the others? Yeah. I don't think they're really afraid of repeating that.

Those exact Snowden documents detailed how Microsoft refused to backdoor Bitlocker despite major pressure from the NSA.

Would like to hear more about this, seems so out of character. Have any links?

Re: What is an SBAT and why does everyone suddenly care

#118

Post by moffkalast » Thu, Aug 22, 2024, 3:38 PM UTC

coldpie wrote: post #68

moffkalast wrote: post #30

Earlier quoted context omitted.

[flagged]

> I thought flatpak would fix this on linux, but every time I flatpak itself updates half of its apps break with mysterious error messages and refuse to launch until they're also updated. Linux oldheads could've told you this would happen before the project was even created. We solved package management and dependencies in the 90s and no one has improved on it since. Just stick with stuff in your distro's repos. If i…

Yeah alright but people want to like, do things.

Re: What is an SBAT and why does everyone suddenly care

#119

Post by dripton » Thu, Aug 22, 2024, 3:39 PM UTC

kuon wrote: post #29

Isn't secure boot the first thing you disable when you install linux?

I installed Linux on a new laptop yesterday, and couldn't get either NixOS or Debian to install until I turned off secure boot. So I guess these distros don't bother getting every release signed by Microsoft.

At least it was easy to turn off. I just wish the error message mentioned Secure Boot -- it took me a few minutes to figure out what was wrong. At first I thought I had a corrupt USB stick or something.

Re: What is an SBAT and why does everyone suddenly care

#120

Post by mixmastamyk » Thu, Aug 22, 2024, 3:42 PM UTC

h4ck_th3_pl4n3t wrote: post #69

notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

> When it comes to the realities of dual-booting The sad and depressing part is that along the way we lost all possibilities of running coreboot or libreboot as an open alternative. The only real option is to buy a used laptop from before the T44x generation (if you really want it secure)... or newer machines that come with other perks like soldered-on batteries that destroy the mainboard along with them when they le…

Framework comes with Intel ME enabled, not able to be disabled, and barely updates their firmware. For example, they left logofail unpatched for a year.