Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

181–190 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#181

Post by kevingadd »

throwawayqqq11 wrote: post #156
eightysixfour wrote: post #59

Earlier quoted context omitted.

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows? Exactly how would you propose starting software securely from an unknown environment? > Back when all this was being introduced I felt that (a) secure boot increases the risk…

What you need is source of trust and right now its signatures which are outsise of the users control. A 5 cent hardware button which gives you a small time windows to install a new trusted bootloader could achieve the same thing without trusting microsoft.

This doesn't actually address some of the scenarios SB is intended for. I.e. you're an IT administrator, you manage a fleet of 1000 machines, you want to ensure that they are all running secure bootloaders and secure kernels and secure software, top to bottom. In that scenario, every end user having a little "security vulnerability" button they can press if they get bored (or feel like being malicious) isn't appealing.

Having to send someone out to press the button at a thousand desks in order to update the bootloader? Also not appealing.

Re: What is an SBAT and why does everyone suddenly care

#182

Post by Bognar »

Animats wrote: post #167
cesarb wrote: post #165

Earlier quoted context omitted.

> Or does installing Windows contaminate the TPM module permanently? It's not the TPM, it's a simple UEFI variable. AFAIK, there's a way in the BIOS to reset all these variables to their original default value, though you might have to use the "clear CMOS" jumper to do it.

> though you might have to use the "clear CMOS" jumper to do it. So installing Windows can break a computer for Linux. That's a great antitrust issue. Microsoft should be fined for that.

It's almost like you didn't read the article. Anyone can increment the variable, and both MS and the Linux communities agreed on the solution.

How dare Microsoft operate within the bounds of an agreed-upon industry standard, what a monopoly!

Re: What is an SBAT and why does everyone suddenly care

#183

Post by offmycloud »

superkuh wrote: post #131

Here is a mirror for anyone else getting blocked* by dreamwidth for not using a corporate browser: https://web.archive.org/web/20240822091216/https://mjg59.dre... * No matter how many times I do the captcha.

Thank you. I had a similar problem in Firefox 129.0.2 on Linux.

Re: What is an SBAT and why does everyone suddenly care

#184

Post by coldpie »

moffkalast wrote: post #166
coldpie wrote: post #123

Earlier quoted context omitted.

If you want to use proprietary software, yeah, you should use Windows. It's built for that. For better or worse, Linux really isn't. Edit: Or use Windows binaries with your distro-provided Wine. Win32 is the only stable user-level Linux API.

Going for a windows build with wine instead of the Linux build sounds completely crazy, but then again Proton works exceptionally well on Steam so this might genuinely be the more long term stable option. I'll have to try that out lmao.

Yeah. It's not the world I would've chosen, but it's the world we've got, lol.

Re: What is an SBAT and why does everyone suddenly care

#185

Post by saagarjha »

imchillyb wrote: post #106
rwmj wrote: post #3

I really hate the error message from shim (or SB in general) when a security check fails. At tell me what exactly failed and what I could do to fix it.

If security vendors followed this logic then all an attacker would have to do is look up the error and render the security moot. By leaving the reason vague an attacker has no immediate feedback and no clue how to remedy. I vastly prefer the way this works now.

Attackers are smarter than you give them credit for

Re: What is an SBAT and why does everyone suddenly care

#186

Post by userbinator »

Obviously people might screw up, but the spec included a way to revoke any signed components that turned out not to be trustworthy

"trustworthy" according to who? Remember that dystopia does not appear spontaneously, but steadily advances little-by-little.

What's the summary? Microsoft (understandably) didn't want it to be possible to attack Windows by using a vulnerable version of grub that could be tricked into executing arbitrary code and then introduce a bootkit into the Windows kernel during boot. Microsoft did this by pushing a Windows Update that updated the SBAT variable to indicate that known-vulnerable versions of grub shouldn't be allowed to boot on those systems.

Who is Microsoft to decide what others do on their machines? Should they have the right to police and censor software they have no control of? In the spirit of Linus Torvalds: Microsoft, fuck you!

We are seeing the scenario Stallman alluded to over 2 decades ago slowly become a reality. He wasn't alone either.

https://www.gnu.org/philosophy/right-to-read.en.html

https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

Things like TPM and "secure" boot were never envisioned for the interests of the user. The fact that it incidentally protects against 3rd party attacks just happened to be a good marketing point.

"Those who give up freedom for security deserve neither."

Re: What is an SBAT and why does everyone suddenly care

#187

Post by Sophira »

0cf8612b2e1e wrote: post #127
kuon wrote: post #29

Isn't secure boot the first thing you disable when you install linux?

This has been my stance for years, but I am open to be persuaded why this is a terrible practice that will lead to kitten murder. I saw someone else give a similar reasoning that if there were a booting error, they would never assume it was a rootkit, but some breakage between all of the booting cruft. I certainly lack any expertise to understand what happens during boot to be able to diagnose problems.

My stance is similar: I insist that any computer I use to run my main OS uses the CSM (Compatibility Support Module) method of booting. This effectively eliminates UEFI's role completely after control is handed to the bootloader, using the pre-UEFI boot method of locating the first sector of the boot device and executing that.

As a user, I see very little benefit to using UEFI.

Re: What is an SBAT and why does everyone suddenly care

#188

Post by palisade »

userbinator wrote: post #186

Obviously people might screw up, but the spec included a way to revoke any signed components that turned out not to be trustworthy "trustworthy" according to who ? Remember that dystopia does not appear spontaneously, but steadily advances little-by-little. What's the summary? Microsoft (understandably) didn't want it to be possible to attack Windows by using a vulnerable version of grub that could be tricked into ex…

I guess in their defense the same attack can be used against any other OS so they're unintentionally protecting Linux as well, since they stated this was supposed to be a Windows-only system change. You can disable secure boot if you don't want to be secure. And, there is a way to disable the SBAT policy and keep secure boot if you want that, which is also insecure. Disable Secure Boot, login, sudo mokutil --set-sbat-policy delete, reboot again, re-enable secure boot. But, then you're susceptible to the attack.

I think understandably, everyone is concerned because it felt like an affront by MS against Linux. But, I don't think that was their thought process at all.

Re: What is an SBAT and why does everyone suddenly care

#189

Post by 3np »

dathinab wrote: post #133
jcalvinowens wrote: post #130

Earlier quoted context omitted.

> I could set it up to auto unlock using TPM2 but I would recommend using a long password. TPM2+password would be optimal. Personally, I trust LUKS with passphrases far more than I trust some random proprietary hardware implementation nobody can audit... It's also important to me to be able to recover the disk contents with the passphrase on another machine if the motherboard dies. Maybe that's what you meant (backup…

I meant: - I'm only using a long password - but it would be optimal to require PCR values and password Note that in any case where you use PCR values you always should setup a secondary way to unlock the partition. Or else you will lose your data if some of your hardware measured into a PCR breaks. Requiring both is optimal as it 1. doesn't rely on TPM/PCRs but 2. prevent certain attack vectors possible with password…

Thanks for sharing your setup!

Nit: It's useful to distinguish between passwords (checked against a hash for auth) and passphrases (used for decryption). It's an important practical distinction because a lost password can in general be bypassed out-of-band somehow while a backup strategy for passphrases is essential.

Re: What is an SBAT and why does everyone suddenly care

#190

Post by 3np »

efitz wrote: post #174
HumblyTossed wrote: post #137

Earlier quoted context omitted.

MS has zero vested interest in caring. If they brake booting for Linux users, how does that hurt them in any meaningful way? Sure they get some press, but is it bad press if most people are never affected by this?

I worked for Microsoft for 17 years, most of that in and around Windows. I can tell you that you are wrong. Whatever the company’s flaws, the people in Windows care deeply about compatibility and about not breaking things with updates. I have hours of stories from the trenches, and could probably talk at length about how such a point of view would be suicidal for the Windows business. I don’t know what went wrong her…

I think there's a distinction between individuals caring and the corporate ("more than the sum" of individuals comprising it) caring.

In that sense, I don't see your experience as invalidating the statement "MS has zero vested interest in caring"?

Post reply on HN