Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot is broken on 200 models from 5 big device makers

arstechnica.com

Post reply on HN
Print view View original

31–40 of 147 posts

Re: Secure Boot is broken on 200 models from 5 big device makers

#31

Post by Hizonner »

drhagen wrote: post #12
Terr_ wrote: post #7

Earlier quoted context omitted.

I'm having strange nostalgic flashbacks the '90s where I kept wondering why nobody offered a hard drive with a physical read-only toggle button. (Mounted to the front of the 5.25 inch bay in a tower chassis, as was the style of the time.) Obviously you need some read+write storage elsewhere on the same computer, but you could reliably freeze large chunks of stuff in a way that would be impervious to viruses or hacker…

I remember USB drives in the '00s that had a read-only toggle. They were useful for rescuing machines that had a virus. Edit: A quick search reveals that, of course, you can still buy them today. I have not felt a need for one in ages.

I strongly suspect that most or all of the modern "hardware" write-protect switches are actually just suggestions to the drive firmware. Which may very well itself be modifiable.

Re: Secure Boot is broken on 200 models from 5 big device makers

#32

Post by jtbayly »

tedunangst wrote: post #29
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

How do you determine when to push the button?

Once a day ought to do…

Re: Secure Boot is broken on 200 models from 5 big device makers

#33

Post by tedunangst »

jandrese wrote: post #18
hex4def6 wrote: post #10

Earlier quoted context omitted.

This has been my theory since Windows 11 required TPM. It's not to protect the consumer, it's to protect the IP-holder. The PC is the lone outlier in the locked-down, walled-garden world of consoles, cell phones, tablets, smart TVs, EVs, etc. I think there's a concerted effort to change that.

Absolutely. Look at all of the changes to the media stack Microsoft made for Vista and none of them are to directly benefit the person who bought the OS license. If you have ever wondered how a 486 could play MP3s and still run X but your modern laptop gets hot and spins the fan when you are playing those same MP3s it is because the media companies demanded it.

If they're literally the same MP3s, it's because modern software sucks. You can still play them with mpg123 with an immeasurably low cpu load.

Re: Secure Boot is broken on 200 models from 5 big device makers

#34

Post by Hizonner »

nightowl_games wrote: post #30

Seems apparent we need a Professional Engineering Certification process and our own disciplinary board similar to other engineering disciplines. High time.

You could probably get away with just forbidding software license agreements that disclaim liability for any and every kind of negligent stupidity.

Re: Secure Boot is broken on 200 models from 5 big device makers

#35

Post by Gormo »

Hizonner wrote: post #31
drhagen wrote: post #12

Earlier quoted context omitted.

I remember USB drives in the '00s that had a read-only toggle. They were useful for rescuing machines that had a virus. Edit: A quick search reveals that, of course, you can still buy them today. I have not felt a need for one in ages.

I strongly suspect that most or all of the modern "hardware" write-protect switches are actually just suggestions to the drive firmware. Which may very well itself be modifiable.

I can't imagine how it would be possible to do it any other way for a flash storage device.

A mechanical hard drive could at least theoretically have a physical lock attached to the drive head which prevents it from approaching the platters if it is engaged.

Re: Secure Boot is broken on 200 models from 5 big device makers

#36

Post by [deleted] »

Terr_ wrote: post #24
drhagen wrote: post #12

Earlier quoted context omitted.

I remember USB drives in the '00s that had a read-only toggle. They were useful for rescuing machines that had a virus. Edit: A quick search reveals that, of course, you can still buy them today. I have not felt a need for one in ages.

Hmmm, I would absolutely buy one of those if it also had a hardened case and a firm connection point for my real-world keychain. The use-case is a "my house burned down what next" backup, password-manager stuff and other details I might need before/without accessing any cloud-backup services. I may need to read some of its files on a not-very trusted device, and I don't want to risk that device also tampering/trojan'…

[deleted]

Re: Secure Boot is broken on 200 models from 5 big device makers

#37

Post by tripflag »

drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

The case you're outlining (an uefi rootkit) is pretty much the worst case; assuming you get infected by some malware which decides to install a malicious firmware (BIOS update), then pretty much nothing is getting in the way of that.

What secureboot is designed to prevent is malicious changes to the OS bootloader (a conventional rootkit), which is usually shimx64.efi or grubx64.efi on linux/dualboot machines, or bootmgfw.efi on windows. Secureboot checks the signature of .efi files before they're allowed to run during boot, ensuring they were signed by one of the trusted keys. And unless you've made changes to your secureboot config, that means microsoft and/or the hardware vendor.

Re: Secure Boot is broken on 200 models from 5 big device makers

#38

Post by Dylan16807 »

tedunangst wrote: post #29
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

How do you determine when to push the button?

Any time you're reinstalling the OS and suspect the old OS had malware.

Or if you want to make it simpler, any time you're reinstalling the OS.

Re: Secure Boot is broken on 200 models from 5 big device makers

#39

Post by kps »

stonogo wrote: post #16
hex4def6 wrote: post #10

Earlier quoted context omitted.

This has been my theory since Windows 11 required TPM. It's not to protect the consumer, it's to protect the IP-holder. The PC is the lone outlier in the locked-down, walled-garden world of consoles, cell phones, tablets, smart TVs, EVs, etc. I think there's a concerted effort to change that.

Indeed, I share this outlook, as do others: https://boingboing.net/2012/01/10/lockdown.html

Better late than never. “The actual user of the PC — someone who can do anything they want — is the enemy.” (Intel, 1999)¹

¹ https://www.zdnet.com/article/the-biggest-security-threat-yo...

Re: Secure Boot is broken on 200 models from 5 big device makers

#40

Post by Dylan16807 »

judge2020 wrote: post #9
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

That sounds correct, but even the savviest of users might not be aware they have malware installed when they decide to re-install windows. If cleaning malware requires pressing a button on the MOBO then I can imagine only a single-digit percentage of users will actually click it.

If they're not worried about malware, and there is some, then they'd probably get reinfected by their data anyway.
Post reply on HN