Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

221–230 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#221

IMO secure boot is a waste of time for most scenarios, if theres closed source EUFI code running god knows what in the background, it dosn't matter how signed and secure your OS kernel is. Ive never been sucessfully able to dual boot windows and linux on a mobo with secure boot turned on, it seems that is a feature not a bug I'm sure MS would never influence hardware vendors to make it dissadvantage a growing number…

TLAs from major powers probably have backdoors in your UEFI, mainboard or OS. But even if they do that doesn't mean they will use them on everyone, they probably keep the good stuff for the most valuable cases. Each use of an attack carries the risk of the attack vector being discovered and prevented in the future. And besides, there are threat actors besides TLAs of the USA, Russia and China. If you use full disk en…

> If you use full disk encryption secure boot is pretty essential, otherwise an attacker can modify the code that asks for your credentials to also log them somewhere easily accessible.

In what threat model? If the attacker has access to your PC they can just as well install a physical keylogger intercepting the signals from the keyboard.

The main use case for disk encryption is preventing data loss when the device is stolen. That's a realistic threat that people face, not boogeyment coming into your house and replacing your bootloader with a malicious one.

Re: What is an SBAT and why does everyone suddenly care

#222

Earlier quoted context omitted.

> If your adversary is a nation state, you've already lost. Is that why it took 10 years to find Bin Laden, the most wanted man on Earth? Get the feeling intel agencies aren't as omnipotent or competent as they want people to believe.

Most of that time he was in a series of caves located in a fairly apathetic nuclear power's boarders. He was also trained and equipped by the CIA. So, if you're willing to live in caves where they can't easily search for you after being trained and equipped by the best of the best, sure, you might live slightly longer. Doesn't seem like a tenable circumstance to me though.

Both your premises are wrong

https://www.theguardian.com/world/2011/may/03/osama-bin-lade...

You know that lies spread online easier than facts. Why make the problem worse?

Re: What is an SBAT and why does everyone suddenly care

#223

Earlier quoted context omitted.

The alternative dystopia is one where the NSA can grab your laptop, rip out the storage, write some code into the boot chain, put the storage back, leave, and you have no evidence to know who did that. Signed code fixes this by requiring someone actually put their name to the code. If it's not someone I recognize, I don't boot. And yes, the NSA could theoretically compromise a signing key with a $5 wrench. But then t…

Pretty sure the NSA as a government agency could make a US company do what you're suggesting for them.

Whether the government was allowed to compel a company to write and sign code was going to be determined in the "Apple-FBI encryption dispute" but the FBI withdrew the day before the hearing since they had found another way to crack the phone without apple's help. I wonder if this will ever be re-litigated or the government just learned its easier to pay someone to write an exploit than it is to pay a company to write a backdoor.

https://www.eff.org/deeplinks/2016/03/deep-dive-why-forcing-...

https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...

Re: What is an SBAT and why does everyone suddenly care

#224

Earlier quoted context omitted.

If your adversary is a nation state, you've already lost. Which gives me another opportunity to quote from my favourite Usenix paper: "In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@ virus-basket.biz.…

> If your adversary is a nation state, you've already lost. Is that why it took 10 years to find Bin Laden, the most wanted man on Earth? Get the feeling intel agencies aren't as omnipotent or competent as they want people to believe.

to be fair, he did lose eventually, and it took the CIA impersonating a vaccine distribution program to take blood samples to find him, which is pretty fucking omnipotent if you ask me, although sowing distrust in vaccine distribution did have some unintended consequences...

Re: What is an SBAT and why does everyone suddenly care

#225

Obviously people might screw up, but the spec included a way to revoke any signed components that turned out not to be trustworthy "trustworthy" according to who ? Remember that dystopia does not appear spontaneously, but steadily advances little-by-little. What's the summary? Microsoft (understandably) didn't want it to be possible to attack Windows by using a vulnerable version of grub that could be tricked into ex…

The alternative dystopia is one where the NSA can grab your laptop, rip out the storage, write some code into the boot chain, put the storage back, leave, and you have no evidence to know who did that. Signed code fixes this by requiring someone actually put their name to the code. If it's not someone I recognize, I don't boot. And yes, the NSA could theoretically compromise a signing key with a $5 wrench. But then t…

Kompromat on a staff engineer is far more effective, sustainable and silent than a five-dollar-wrench attack

Re: What is an SBAT and why does everyone suddenly care

#226
Fun fact. Just as this story was unfolding, I was installing a Debian system on an Acer desktop machine. The Debian installer wouldn't start with secure boot enabled because of this, but also, once I fixed up things, I couldn't get the firmware to recognize any entry added by Debian. It would hide and deactivate them on its own. I ultimately had to use a copy of the EFI partition on a USB key for it to work.

Re: What is an SBAT and why does everyone suddenly care

#228

Earlier quoted context omitted.

IIRC Intel iGPUs support it and I read somewhere that their dGPUs do as well, but I might be misremembering.

Well that's one big feature that would entice me to buy an intel gpu in the future

This is also the only reason I ever thought of buying an Intel GPU, but then I realized "Wait, if I am buying a new GPU I can just use my old GPU for host/passthrough. I don't need a new GPU that is roughtly as good as my current one just for SR-IOV, I'd want one at least much better than my current one" (RX 5600XT, not really top but it does its job)

Re: What is an SBAT and why does everyone suddenly care

#229

This hit me 2 days ago as I was shuffling dual boot systems around trying to recover some old data for a client. Kind of hilarious timing tbh, right after I was done laughing arrogantly about CrowdStrike

Yah, I got hit by this as well. Was pulling some stuff off of windows, it updated overnight, rebooted, and I woke up to my default Ubuntu boot being horked. A bit of a WTF till I started searching for it. I'll be backing up and leaving that box as Linux + a vm.

Re: What is an SBAT and why does everyone suddenly care

#230

Earlier quoted context omitted.

You could if you want to, but if your distribution provides a UEFI bootloader (shim / grub / systemd-boot / whatever) signed by the default MS-trusted cert, or you're willing to set up everything yourself with your own certs, it doesn't hurt to enable it either (except when an incident like this happens).

The Mint forums pretty much tell everyone to blanket disable secure boot because nobody seems to know how to make it work, certainly not well enough to explain it to a beginner.

I accidentally checked "install media codecs" on the Mint installation which requires secure boot. Didn't think much of it but something went wrong later on in the setup causing a restart. Well, it left the secure boot stuff in a weird state and forced me to reset the CMOS because nothing was working or booting.
Post reply on HN