Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

151–160 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#151

Post by rolph »

ctroein89 wrote: post #146
xnzakg wrote: post #7

Earlier quoted context omitted.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

Good error messages are hard. You want to tell the user what to do, but if you knew that the error could be thrown, you probably should have been gracefully handling the problem. You don't know what information is useful to a hacker and you don't know how your error will be propagated. Meaningful errors at one level ("incorrect parameters passed" when calling an API) is perfectly useless at another level ("incorrect…

all information is useful to a hacker. if you can find a way to use information beyond creators intent, to achieve your goals regardless of hat color, you are hacking.

Re: What is an SBAT and why does everyone suddenly care

#152

Post by teddyh »

dripton wrote: post #119
kuon wrote: post #29

Isn't secure boot the first thing you disable when you install linux?

I installed Linux on a new laptop yesterday, and couldn't get either NixOS or Debian to install until I turned off secure boot. So I guess these distros don't bother getting every release signed by Microsoft. At least it was easy to turn off. I just wish the error message mentioned Secure Boot -- it took me a few minutes to figure out what was wrong. At first I thought I had a corrupt USB stick or something.

You don’t always have to disable Secure Boot; it usually works with just changing some “OS Type” from “Microsoft” to “Other”.

Re: What is an SBAT and why does everyone suddenly care

#153

Post by cesarb »

dripton wrote: post #119
kuon wrote: post #29

Isn't secure boot the first thing you disable when you install linux?

I installed Linux on a new laptop yesterday, and couldn't get either NixOS or Debian to install until I turned off secure boot. So I guess these distros don't bother getting every release signed by Microsoft. At least it was easy to turn off. I just wish the error message mentioned Secure Boot -- it took me a few minutes to figure out what was wrong. At first I thought I had a corrupt USB stick or something.

There are two separate Secure Boot keys Microsoft uses: one which they use to sign Windows, and another which they use to sign everything else (the "Microsoft 3rd Party UEFI CA"). AFAIK, some recent laptops with Windows preinstalled come by the default with the second one disabled in the BIOS (it's a new Microsoft requirement). To install Linux on these laptops without disabling Secure Boot, you have to go into the BIOS and enable that key.

Re: What is an SBAT and why does everyone suddenly care

#154

Post by gorjusborg »

Hydrocarb0n wrote: post #41

IMO secure boot is a waste of time for most scenarios, if theres closed source EUFI code running god knows what in the background, it dosn't matter how signed and secure your OS kernel is. Ive never been sucessfully able to dual boot windows and linux on a mobo with secure boot turned on, it seems that is a feature not a bug I'm sure MS would never influence hardware vendors to make it dissadvantage a growing number…

I've been using 'secure boot' with Debian for a while now. They use a signed first-stage boot loader that allows booting the OS.

I have similar doubts on whether my system is significantly more secure as a result of using it.

Re: What is an SBAT and why does everyone suddenly care

#155

Post by gruez »

immibis wrote: post #122
gruez wrote: post #32

Earlier quoted context omitted.

[flagged]

The German government caused Let's Encrypt to issue fraudulent certificates to xmpp.ru and jabber.ru by physically intercepting the server's network connection. https://news.ycombinator.com/item?id=37961166

That's not the same as OP'a claim, which asserts three letter agencies have access to the private keys.

Re: What is an SBAT and why does everyone suddenly care

#156

Post by throwawayqqq11 »

eightysixfour wrote: post #59
pjc50 wrote: post #49

Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows? Exactly how would you propose starting software securely from an unknown environment? > Back when all this was being introduced I felt that (a) secure boot increases the risk…

What you need is source of trust and right now its signatures which are outsise of the users control.

A 5 cent hardware button which gives you a small time windows to install a new trusted bootloader could achieve the same thing without trusting microsoft.

Re: What is an SBAT and why does everyone suddenly care

#157

Post by rolph »

BlueTemplar wrote: post #143
pjc50 wrote: post #49

Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…

I have seen recommendations to not dual boot with non-obsolete Windows, because its updates would have a high risk of screwing up grub, but instead give that Windows it's own hard drive, and boot it 'manually', by selecting the boot drive at startup in the 'BIOS'. Sounds like that was good advice ?

Personally, as part of powerup procedure, i use a hot swap bay, and select a ddrive from a rack, for the work i have in mind.

Re: What is an SBAT and why does everyone suddenly care

#158

Post by zahlman »

Arnavion wrote: post #128
kuon wrote: post #29

Isn't secure boot the first thing you disable when you install linux?

You could if you want to, but if your distribution provides a UEFI bootloader (shim / grub / systemd-boot / whatever) signed by the default MS-trusted cert, or you're willing to set up everything yourself with your own certs, it doesn't hurt to enable it either (except when an incident like this happens).

The Mint forums pretty much tell everyone to blanket disable secure boot because nobody seems to know how to make it work, certainly not well enough to explain it to a beginner.

Re: What is an SBAT and why does everyone suddenly care

#159

Post by monocasa »

rolph wrote: post #150
voxic11 wrote: post #81

Earlier quoted context omitted.

Congress already granted retroactive immunity for telecoms acting in cooperation with the US government with the FISA Amendments Act of 2008. I don't see why they couldn't do the same for Microsoft (assuming the law doesn't already apply to them). > Release from liability - No cause of action shall lie in any court against any electronic communication service provider for providing any information, facilities, or ass…

"any information" suggests wrong information wont evoke cause of action in any court.

I would be shocked if a judge interpreted that to include essentially willful perjury (or at least false statements) to a national security agency.

Re: What is an SBAT and why does everyone suddenly care

#160

Post by ploxiln »

zokier wrote: post #11

Major question for me is, are the grubs that are getting rejected completely unpatched, or were they patched by distros without updating the "security generation"? I'd be also really curious to hear how MS was attempting to do dual-boot detection, I hope someone (more skilled than I) would reverse engineer that bit from the update.

I agree, this is the key question. It seems like all the distros, and microsoft, need to coordinate on the "security generation", whenever grub (or other linux boot component) releases an update or patch? Maybe that's an extra annoyance they didn't have before, so until now they just left that number alone, and kinda forgot about it?
Post reply on HN