Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft terminates VeraCrypt account, halting Windows updates

404media.co

Post reply on HN
Print view View original

181–190 of 259 posts

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#181

Post by arcfour »

whatevaa wrote: post #136
arcfour wrote: post #91

Earlier quoted context omitted.

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…

Full disk encryption protects from somebody yanking a hard drive from running server (actually happens) or stealing a laptop. Calling it useless because it doesn't match your threat model... I hate todays security people, can't threat model for shit.

I (the commenter you responded to) am a security engineer by trade and I'm arguing that SB is useful. I'm not sure if the parent commenter is or isn't a security person but my interactions with other people in the security field have given me the impression that most of them think it's good, too.

So I'm a little confused about the "can't threat model for shit part," I think these sorts of attacks are definitely within most security folks threat models, haha

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#182

Post by jyrkesh »

cyberax wrote: post #118
serf wrote: post #97

Earlier quoted context omitted.

>It's necessary for FDE to have any sort of practical security why? do you mean because evil maid attacks exist? anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot. >bootkits are a security nightmare and would otherwise be much more common in malware why weren't they more common before? serious question. Back in the 90s viruses…

> serious question. Back in the 90s viruses were huge business, No, they were not. They were toys written for fun and/or mischief. The virus authors did not receive any monetary reward from writing them, so they were not even a _business_. So they were the work of individuals, not large teams. The turning point was Bitcoin. Suddenly it provided all those nice new business models that can be scaled up: mining, stealin…

Malware was absolutely used to sell botnet access in the 90s, millions of Windows machines were used for DDoS and as anonymous proxies

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#183

Post by AnthonyMouse »

mschuster91 wrote: post #178
AnthonyMouse wrote: post #166

Earlier quoted context omitted.

> no internet (e.g. something like Iran)? Your device is effectively bricked. If your threat model is Iran and you want the device to boot with no internet then you memorize the long passphrase. > heavily monitored internet (e.g. China, USA)? It's probably easy enough for the government to snoop your connection metadata and seize the physical server. The server doesn't have to be in their jurisdiction. It can also us…

> If your threat model is Iran Well... they wouldn't be the first ones to black out the Internet either. And I'm not just talking about threats specific to oneself here because that is a much different threat model, but the effects of being collateral damage as well. Say, your country's leader says something that makes the US President cry - who's to say he doesn't order SpaceX to disable Starlink for your country? O…

> Say, your country's leader says something that makes the US President cry - who's to say he doesn't order SpaceX to disable Starlink for your country?

Then you tether to your phone or visit the local library or coffee shop and use the WiFi, or call into the system using an acoustic coupler on an analog phone line or find a radio or build a telegraph or stand on a tall hill and use flag semaphore in your country that has zero cell towers or libraries, because you only have to transfer a few hundred bytes of protocol overhead and 32 bytes of actual data.

At which point you could unlock your laptop, assuming it wasn't already on when you lost internet, but it still wouldn't have internet.

> The OS can verify everything being executed prior to its startup back to a trusted root.

Code that asks for the hashes and verifies them can do that, but that part of your OS was replaced with "return true;" by the attacker's compromised firmware.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#184

Post by [deleted] »

201984 wrote: post #158
bigfatkitten wrote: post #134

Earlier quoted context omitted.

It does no such thing if you enrol your own keys using the extremely well documented process to do that.

Where is this "extremely well documented process" to enroll new signing keys on an embedded device? I don't see one for any of these embedded processors with secure boot. https://pip-assets.raspberrypi.com/categories/1214-rp2350/do... https://documentation.espressif.com/esp32_technical_referenc... https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm

[deleted]

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#185

Post by arcfour »

jrm4 wrote: post #174
arcfour wrote: post #163

Earlier quoted context omitted.

So everyday users should be vulnerable to bootkits and kernel-mode malware...why, exactly? That is useful security. The fact that people do not pursue this type of malware very frequently is an effect of SB proliferation. If it were not the default then these attacks would be more popular.

[flagged]

Citation for what? The existence of bootkits?

Petya/NotPetya, Alureon, Carberp/Rovnix, Gapz, LoJax (firmware rootkit!).

All of these attacks would be thwarted by SB (and in Petya's case, simply having UEFI enabled at all, since that was only for BIOS machines)

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#186

Post by arcfour »

fsflover wrote: post #142
arcfour wrote: post #91

Earlier quoted context omitted.

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…

Instead of proprietary SecureBoot controlled by megacorps, you can use TPM with Heads based entirely on FLOSS with a hardware key like Librem Key. Works for me and protects from the Evil Maid attack.

You can also use SB with your own keys (or even just hashes)...just because Microsoft is the default included with most commercially sold PCs—since most people use Windows on their PCs—doesn't mean SB is controlled by them. You can remove their signing cert entirely if you want. I have done this and used my own.

Plus they signed the shim loader for Linux anyways so they almost immediately gave up any "control" they might have had through SB.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#187

Post by michaelt »

tsujamin wrote: post #74
VadimPR wrote: post #58

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…

For what it’s worth, Trusted Signing verification has been a moving target over the last 12 months. It was open for individuals, then it was closed to anyone except (iirc) US businesses with DUNS numbers, then it opened again to US based individuals (and a few other countries perhaps). My completely uninformed guess was that someone had done something naughty with Trusted Signing-issued code signing certificates. Any…

I don't know anything about Trusted Signing verification, but I do know from reports on 'mini umbrella company fraud' that if you're a fraudster, there are people in the Philippines who will happily sign their name to western countries' official paperwork in exchange for $2000 or so. Understandably, as that's more than the country's median annual income.

So I can see why offering trusted signing for individuals worldwide would come with certain challenges.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#188

Post by ai5iq »

Lihh27 wrote: post #10

heh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk

This is the same pattern playing out everywhere. The platform giveth, the platform taketh away. If your software's distribution depends on one company's good graces, you don't really ship it they do

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#189

Post by ray_v »

miki123211 wrote: post #115
ghighi7878 wrote: post #67

Earlier quoted context omitted.

Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl

But that's how it already works. If you install Windows first, Microsoft takes control (but it graciously allows Linux distros to use their key). If you install Linux first, you take control. It's perfectly possible for you to maintain your own fully-secure trust chain, including a TPM setup which E.G. lets you keep a 4-digit pin while keeping your system secure against brute force attacks. You can't do that with the…

It's funny, but I just encountered this for the first time the other day - feels like I had to do a lot of digging to find out how to do this so that I could add my LUKS key to my TPM... really felt like it took some doing on the HP all-in-one that I was trying to put debian on... maybe because it was debian being debian

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#190

Post by heavyset_go »

arcfour wrote: post #110
CodesInChaos wrote: post #106

Earlier quoted context omitted.

And will then be locked out from an increasing amount of Applications, Media, and eventually even Websites.

I run Linux with Secure Boot and I don't feel locked out of any media, applications, or websites. My mom uses Secure Boot with Windows and doesn't know or care that it's enabled at all.

The OP is describing the status quo on mobile phones and tablets. On mobile Secure Boot, and systems like it, are used to lock out the user. If the boot path integrity is altered, some apps won't work or will provide degraded experiences.

What's happening the article is what has already happened on mobile: it requires vendor signing to run anything on mobile OS and the vendor locks out 3rd party drivers from their OS entirely.

It's yet another step towards desktop computing converging with mobile when it comes to software/firmware/boot/etc integrity attestation, app distribution and signing, and the ability to use your own bootloader and system drivers. When Secure Boot was first rolled out on laptops, it was used by Microsoft to lock the user out of the boot process before it was adapted to let users register their own keys, it can always be used for its original purpose, and how it's currently used on mobile, again.

Post reply on HN