Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org

Post reply on HN
Print view View original

71–80 of 276 posts

Re: What is an SBAT and why does everyone suddenly care

#71

Post by skywhopper »

eightysixfour wrote: post #59
pjc50 wrote: post #49

Something seems to be wrong with the whole security model. > those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compr…

> This feels like a "my secure compartments are all connected together" moment. If Microsoft want to verify that they're in an all-Microsoft boot chain, sure, whatever, fine. But somehow the compromise of any loader allows compromise of Windows? Exactly how would you propose starting software securely from an unknown environment? > Back when all this was being introduced I felt that (a) secure boot increases the risk…

> Exactly how would you propose starting software securely from an unknown environment?

Accept that it’s impossible?

Re: What is an SBAT and why does everyone suddenly care

#72

Post by ziml77 »

immibis wrote: post #20
xnzakg wrote: post #7

Earlier quoted context omitted.

Seems to be a general trend in a lot of software nowadays. Vague error messages telling you "Something went wrong" with no additional details.

It's not a new trend - error-code based software would propagate that ERROR_INVALID_PARAMETER all the way from the function with the invalid parameter back out to the return value of the user operation, then helpfully tell the user "Invalid parameter!" Exceptions with string messages and full stack traces might be yet another underrated Java invention.

God that error is nearly useless even to the developer. Last couple of times I've gotten it, I've dropped the DLL that the error originates from into Binary Ninja and run the debugger to figure out which parameter failed a check.

Re: What is an SBAT and why does everyone suddenly care

#73

Post by Deathmax »

Filligree wrote: post #56
0l wrote: post #42

Earlier quoted context omitted.

Certificate transparency is intended to solve this issue.

Why wouldn't the TLA override that as well? Perhaps by leaning on the company that supposedly owns the domain.

That would be compromising the domain owner, rather than the threat model of Certificate Transparency which is compromised Certificate Authorities, especially given the number of government owned, publicly trusted (sub-)CAs.

Re: What is an SBAT and why does everyone suddenly care

#74

Post by wongarsu »

Filligree wrote: post #56
0l wrote: post #42

Earlier quoted context omitted.

Certificate transparency is intended to solve this issue.

Why wouldn't the TLA override that as well? Perhaps by leaning on the company that supposedly owns the domain.

The browser is verifying that the certificate appears in public certificate logs. So if a TLA forges a certificate (whether with the cooperation of a certificate provider, DNS provider or domain owner) that is now part of the public record. And if they do it with any domain that has enough eyeballs, someone would presumably notice. Not to mention that it's an easy way for agencies from rival countries to tip a reporter or security researcher off that it happened.

Of course in reality most browsers don't actually check the certificate logs but only require timestamps signed by certificate logs that prove that at least two certificate logs know of the certificate. A TLA that can pressure at least two logs to provide those timestamps without actually publishing the certificates isn't really stopped. But at least that widens the circle of people who have to be in on the conspiracy.

In a perfect world browsers would do spot checks against the actual certificate logs, and require that the signed timestamps are from logs that are unlikely to be influenced by the same actor (e.g. a Western, a Russian-sphere and a Chinese-sphere certificate log). Your guess why we don't do either is as good as mine

Re: What is an SBAT and why does everyone suddenly care

#75

Post by malwrar »

jpnc wrote: post #48
notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

>tweak QEMU for performance and passthrough Any guide you could link to that covers all of this? I would like to setup a very performant windows VM.

https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF

Note that it requires a second graphics card to work.

Re: What is an SBAT and why does everyone suddenly care

#76

Post by duped »

9dev wrote: post #54
moffkalast wrote: post #30

Earlier quoted context omitted.

[flagged]

This is really bad advice—don't follow it. Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly. Running critical software without updating may have been possible in some distant past, but it isn't any longer: You will catch an exploit or crypto locker at some point. Microsoft abusing its update mechanism to pushing crap is nothing new, but downright refusing u…

> Zero day vulnerabilities are a thing, and you intentionally prevent yourself from getting those fixed quickly.

And yet, Windows updates are a bigger threat to me than malware.

Re: What is an SBAT and why does everyone suddenly care

#77

Post by TiredOfLife »

ab71e5 wrote: post #22

> Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. I wonder what went wrong here? If you would read the EFI boot order it would clearly say to boot shim first? Or were these dual boot setups where the…

People that dualboot are probably also people that run random debloat scripts that disable telemetry. So when such system broke there was no signal it happened.

Re: What is an SBAT and why does everyone suddenly care

#78

Post by RobotToaster »

notarealllama wrote: post #16

I think there's more than meets the eye here. I think part of the reason MS is enforcing TPM2.0 and now this SBAT update is that there is widespread rootkit level malware and they are trying to stay ahead of the curve. When it comes to the realities of dual-booting, I had tons of problems with Win7/8/10 with suspend-to-hiberfile.sys issues and updates 10 years ago breaking grub. 10 years ago I finally decided, "You k…

It would be entirely unsurprising if most TPMs had a clipper chip[0] like backdoor.

[0] https://en.wikipedia.org/wiki/Clipper_chip

Re: What is an SBAT and why does everyone suddenly care

#79

Post by mtlmtlmtlmtl »

BaculumMeumEst wrote: post #18
mtlmtlmtlmtl wrote: post #5

This sort of thing is exactly why I have automatic updates disabled on my Windows partition. I've been burned so many times by bad Windows updates breaking stuff. My favourite is when stuff breaks during the "configuring updates" stage after a reboot, leaving Windows in a boot loop with no error codes or anything to help you figure it out. And of course the documentation from MS is utter garbage. Most of the time the…

My Windows install is stuck in a boot loop like this - it spends 10 minutes trying to update and then fails, except maybe 1/3 times it then boots normally. I don't even try to do anything about it, I just marvel at it.

Yeah, it turns out applying updates during boot is bad design. I'm sure plenty of people at MS realise it is, but I guess they don't care enough to fix it.

Re: What is an SBAT and why does everyone suddenly care

#80

Post by tostiheld »

teekert wrote: post #58

A recent Linux Unplugged episode went into how one can use the TPM to set up a secure and trusted chain of trust for the booting process on Linux [0] using Clevis [1], very interesting! [0] https://linuxunplugged.com/572 [1] https://fedoramagazine.org/automatically-decrypt-your-disk-u...

The "new" way of doing this would be using systemd-cryptenroll [0]. I did this recently on Ubuntu 24.04. I actually tried the default LUKS+TPM shipped with Ubuntu 24.04 at first [1], but it was a bit disappointing because it locks you into using snap-based kernels. This means you cannot install custom DKMS modules (which I needed). Although Clevis is very interesting software (you can even unlock based on some other computer in your network [2]), it's not absolutely required anymore for LUKS+TPM.

[0] https://fedoramagazine.org/use-systemd-cryptenroll-with-fido...

[1] https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-c...

[2] https://docs.redhat.com/en/documentation/red_hat_enterprise_...

Post reply on HN