What is an SBAT and why does everyone suddenly care

Post by ChoHag » Fri, Aug 23, 2024, 3:02 PM UTC

palisade wrote: post #188

userbinator wrote: post #186

Obviously people might screw up, but the spec included a way to revoke any signed components that turned out not to be trustworthy "trustworthy" according to who ? Remember that dystopia does not appear spontaneously, but steadily advances little-by-little. What's the summary? Microsoft (understandably) didn't want it to be possible to attack Windows by using a vulnerable version of grub that could be tricked into ex…

I guess in their defense the same attack can be used against any other OS so they're unintentionally protecting Linux as well, since they stated this was supposed to be a Windows-only system change. You can disable secure boot if you don't want to be secure. And, there is a way to disable the SBAT policy and keep secure boot if you want that, which is also insecure. Disable Secure Boot, login, sudo mokutil --set-sbat…

Post by fsflover » Fri, Aug 23, 2024, 3:41 PM UTC

bigiain wrote: post #202

dmbche wrote: post #197

Earlier quoted context omitted.

I mean can you actually protect against the NSA? After Stuxnet, I fully trust that nation/state actors can infect whatever they put their mind to - I'd rather at least have control over my machine

If your adversary is a nation state, you've already lost. Which gives me another opportunity to quote from my favourite Usenix paper: "In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@ virus-basket.biz.…

Post by HumblyTossed » Fri, Aug 23, 2024, 4:36 PM UTC

unethical_ban wrote: post #149

HumblyTossed wrote: post #138

Earlier quoted context omitted.

I have had occasional issues with Windows and various flavors of Linux hibernating but nothing that happens with any regularity - at all - and nothing that can't be solved by simply rebooting.

I shouldn't have to reboot in order to fix sleep or hibernate. Their reason for existence is to avoid the need to shut down and restart.

Post by Arnavion » Fri, Aug 23, 2024, 6:01 PM UTC

zahlman wrote: post #158

Arnavion wrote: post #128

Earlier quoted context omitted.

You could if you want to, but if your distribution provides a UEFI bootloader (shim / grub / systemd-boot / whatever) signed by the default MS-trusted cert, or you're willing to set up everything yourself with your own certs, it doesn't hurt to enable it either (except when an incident like this happens).

The Mint forums pretty much tell everyone to blanket disable secure boot because nobody seems to know how to make it work, certainly not well enough to explain it to a beginner.

Post by sedatk » Fri, Aug 23, 2024, 8:01 PM UTC

userbinator wrote: post #198

sedatk wrote: post #194

Earlier quoted context omitted.

> Who is Microsoft to decide what others do on their machines? That would be an amazing rant had it only ended with "Sent from my iPhone". Since the Blaster worm incident two decades ago, we're in a new era where security at scale becomes the forefront responsibility of the companies developing the product. That includes writing more secure code, having more verifications in place, adopting more secure technologies,…

Blaster was Microsoft's own incompetence. CrowdStrike was CrowdStrike's own incompetence. They are free to fix the problems of their own doing. But messing with software you do not own, on machines you do not own, crosses a line and should be considered an act of aggression. What if some Linux distro releases an update that deletes any installations of Windows it finds "because Windows is insecure" (according to them…