Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot in the Era of the T2

duo.com

Post reply on HN
Print view View original

31–40 of 97 posts

Re: Secure Boot in the Era of the T2

#31

Post by geofft »

userbinator wrote: post #6
Shank wrote: post #3

> Apple should be lauded for trying to bring their laptop and desktop lines into the same defensive posture as their mobile offerings. I think this can't be stated enough. The fact of the matter is that pre T2, evil maid attacks were ridiculously easy. Now they're at least as secure as iOS -- which also means that shared vulnerabilities can be patched and detected. By no means is it perfect security, but it's a heck…

which is great for data privacy. ...and absolutely horrible for freedom. It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. Now companies are turning the security against users, lest they also be attackers. From the point of view of the DRM-advocating media corporations, the user is an attacker. Locking down the…

> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer.

It still does. The only thing is we've distinguished physical ownership and mere physical possession.

It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my freedom - both my computing freedom and my physical freedom - if I can leave a laptop in my hotel room while seeing tourist sights. It protects me from the government if a border control agent looking through my bag, or a cop who's seized my laptop, can't get in. (The iPhone is an existence proof that such defense against the government is possible, and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.)

Of course software freedom requires access control. My freedom over my possessions involves other people's lack of freedom over my possessions. I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to. This control is essential liberty; pretending that anyone with physical access is an owner because it's easier than crypto and key management has been decades of temporary convenience, and I'm glad it's coming to an end.

I can turn secure boot on and off with an admin password, which I set when I first booted the machine because that's what demonstrates physical ownership and not mere possession. (And systems that don't permit me to do so, like Microsoft or Apple ARM devices, are in fact an affront to software freedom.) But nobody else can.

Re: Secure Boot in the Era of the T2

#32

Post by Dunedan »

saagarjha wrote: post #28
josteink wrote: post #22

Earlier quoted context omitted.

> Does this have any bearing on running linux on macbooks Unlike on PCs, on T2 Macs Linux will only be bootable with Secure boot disabled making the system much less secure. To make matters worse, the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything. When Apple stops supporting this machine, you won’t be able to keep it chugging by loading another OS.…

> the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything. This isn’t true. You can install Linux on this, providing you disable Secure Boot. You can’t currently access the SSD, but that’s more the result of a driver not existing than it being inherently disallowed.

> You can’t currently access the SSD, but that’s more the result of a driver not existing than it being inherently disallowed.

That's not clear yet. There is a NVMe driver available in Linux which works fine with pre-T2 Macs. On T2 Macs however the whole platform resets a few seconds after initializing the NVMe controller. The question is: Is that a bug in the driver or NVMe implementation of the T2 chip or something Apple does intentionally?

Re: Secure Boot in the Era of the T2

#33

Post by voltagex_ »

geofft wrote: post #27
cmurf wrote: post #19

Earlier quoted context omitted.

Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim boo…

> Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. I see this said a lot, and I find it baffling because so many Linux users demanded no secure boot at all - which is exactly the thing being called unacceptable now. (It's not just you; The Register , for instance, complained about how "malware or malicious users that gets onto your Mac can pot…

I think that secure boot got maligned as non-removable options were conflated with the ones where you could enroll keys.

Re: Secure Boot in the Era of the T2

#34

Post by nneonneo »

josteink wrote: post #24

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot capabilities to the mass market. So the vast PC-market with UEFI secure boot which predates this by 6 year was somehow not the “mass market”, but the relatively tiny MacBook market is? With factual errors like this present already in the introduction, it’s ha…

Serious question - how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Online docs focus mostly on the software/firmware security but less on the hardware side. Is hardware security specified, or left up to individual vendors?

Re: Secure Boot in the Era of the T2

#35

Post by scarface74 »

LeoNatan25 wrote: post #25
scarface74 wrote: post #10

Earlier quoted context omitted.

Tell that to the million of Windows users that have 10 toolbars on their browser, ransomware, etc....

2001 called, it wants its outdated Windows memes back.

Yes because there aren’t users that are downloading web extensions that are malware, getting infected with ransomware, and programs that secretly mine crypto currency.

My mom was just looking for a printer driver (why are printer drivers even a thing on Windows in 2018?) and ended up with all kind of crap on her computer after going to the first site she saw on Google.

A friends mother told me that when she is on her computer she can see someone else controlling it remotely.

Re: Secure Boot in the Era of the T2

#36

Post by eikenberry »

geofft wrote: post #31
userbinator wrote: post #6

Earlier quoted context omitted.

which is great for data privacy. ...and absolutely horrible for freedom. It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. Now companies are turning the security against users, lest they also be attackers. From the point of view of the DRM-advocating media corporations, the user is an attacker. Locking down the…

> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. It still does. The only thing is we've distinguished physical ownership and mere physical possession. It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my…

You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.

Re: Secure Boot in the Era of the T2

#37

Post by josteink »

nneonneo wrote: post #34
josteink wrote: post #24

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot capabilities to the mass market. So the vast PC-market with UEFI secure boot which predates this by 6 year was somehow not the “mass market”, but the relatively tiny MacBook market is? With factual errors like this present already in the introduction, it’s ha…

Serious question - how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Online docs focus mostly on the software/firmware security but less on the hardware side. Is hardware security specified, or left up to individual vendors?

> how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine?

Everything is relative.

When enabled, what Secure Boot ensures is that only boot media signed by a trusted a key (which unless user-replaced, typically are the vendor-provided key which trusts MS Windows and common Linux-distros) can be booted.

This guarantees that the base OS and kernel booted by the machine can be trusted to not be tampered with by untrusted parties. That is, the most important part of the OS is protected against malicious modifications and attacks by the firmware.

However if this is the only security-measure you have, there is nothing preventing a physical attacker from extracting the drive into another machine, and on this machine modify non-boot related OS-files to introduce a backdoor or trojan, and then put the drive back into the original machine.

You will then boot a trusted kernel, which later on may load malicious code. Secure boot alone does not protect against a scenario like this.

But if you use Secure Boot together with and BitLocker, LUKS or other full-disk encryption solutions, you should be reasonably secure, even against physical attackers.

Basically Secure Boot is not a full security solution, but it is the base which you need for a fully trusted, tamper-proof computing environment. Without it, you wouldn't know if someone is logging your password or not when unlocking the encrypted drives.

Re: Secure Boot in the Era of the T2

#38

Post by X-Istence »

saagarjha wrote: post #23
cmurf wrote: post #19

Earlier quoted context omitted.

Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim boo…

> And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. No way. The typical user will leave it enabled because they will only use macOS.

Bootcamp will also install Microsoft's root for UEFI so that Windows 10 can run fully secure.

Re: Secure Boot in the Era of the T2

#39

Post by lisper »

eikenberry wrote: post #36
geofft wrote: post #31

Earlier quoted context omitted.

> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. It still does. The only thing is we've distinguished physical ownership and mere physical possession. It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my…

You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.

This can't be stressed enough. Freedom (indeed "ownership") means that I should be able to run any app I want on my device without having to create an account with Apple. It would be great if I could have both freedom and security, but Apple has decided that is not an option. I have to choose one or the other.

I choose freedom.

Re: Secure Boot in the Era of the T2

#40

Post by X-Istence »

josteink wrote: post #24

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot capabilities to the mass market. So the vast PC-market with UEFI secure boot which predates this by 6 year was somehow not the “mass market”, but the relatively tiny MacBook market is? With factual errors like this present already in the introduction, it’s ha…

You are missing the bigger picture in your attempt to immediately discard the original articles premise because you feel like it comes off as fanboy-fluff.

No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting.

It's not just secure boot, which has been around for a while, it's everything around it.

On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). There is no verification of the UEFI boatloader that is possible because it's sitting in NVRAM or Flash... and you can't trust it to self-verify because it may have been tampered with.

Post reply on HN