Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from.

And you need that for recovery purposes, at least.



> How is it a dangerous attack vector?

The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?).

Not trusting external and/or removable storage as a valid bootable source is a sensible default.

p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.


And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways?

The ubuntu usb key you are booting is safer than what you already got installed...


Funny thing here is that the feature OP stumbled upon, Device Guard, does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one.


This is ridiculous. Lenovo controls all the preinstalled software as well as the drivers that are shipped with the device. Any of them could install a Superfish-like thing at any point.


They may control those parts, but Device Guard won't let you install most rootkits. Starting from Secure Boot and Virtualization Based Security ending with Trusted Boot, the system should be capable of rejecting unsigned privileged components and remain secure. Then an AV is probably capable of detecting and removing actual malware.

Still not perfect, but way better than without.


Superfish was not a kernel rootkit by any measure of the word. You just have to install a new CA then a NDIS filter, neither of these is either a rare or even blocked operation since they are required for preinstalled software such as drivers or even an AV. There would be absolutely no difference on whether you used Secure Boot or not.

But worst of all: Superfish was actually _signed_ itself. MS has improved the level of vetting they do now, specially for kernel drivers, but how come anyone can still claim with a serious face that a signature requirement from one CA specifically improves security against malware _from that CA_ (or their associates) ?


> Superfish was not a kernel rootkit by any measure of the word.

I didn't say it was, you kinda ignored the context. The person who I replied to was asking how can they trust their Windows is genuine, I replied to them that the feature causing a stir here does protect against some types of malware.

It's a fair assumption that the next thing akin to Superfish would try to implant itself deeper, if given the chance, Device Guard does eliminate some of those ways.

> for preinstalled software such as drivers

If that driver is actually malicious then Early-Launch Antimalware alongside the kernel being protected, can get rid of it.

> There would be absolutely no difference on whether you used Secure Boot or not.

I wasn't talking exclusively about Secure Boot.

> But worst of all: Superfish was actually _signed_ itself.

Sure, now there's a toggle that won't trust some signatures that aren't as heavily vetted (amongst many other things). How is that "ridiculous" or "won't make a difference". Are you just looking for a reason to argue?


OK. You literally said:

> [Device Guard] does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one.

Which is the infamous Lenovo malware "preinstallation method" ?

How would a signature system would have prevented malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image shipped with Lenovo hardware ?


> OK. You literally said:

Yes, and I didn't call it a "kernel rootkit" as you said I did.

> How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ?

Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.


Superfish was never shipped with WPBT (it was preinstalled), so please do make explicit which malware you are referring to.


> And how do you trust and inspect that the Windows you got installed when bought the laptop is genuine without any modifications anyways?

Lenovo does that for you

They are legally responsible.

> The ubuntu usb key you are booting is safer than what you already got installed...

Have you read my post?

I use Linux, I'm writing from Debian, on a Lenovo laptop.

It took 10 seconds to allow Linux to boot.


> I use Linux, I'm writing from Debian, on a Lenovo laptop. > It took 10 seconds to allow Linux to boot.

On this specific Z13? Or other model, which wasn't "improved" yet?


it's simply a matter of disabling secure boot.

10 seconds at most.

no need for being sarcastic.


And that's exactly the wrong solution.

I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't.

There was no sarcasm.


> And that's exactly the wrong solution.

it's a solution

it's only a matter of choice, there's no wrong choice, choices are personal.

You're complaining about something that's very easy to overcome.

> I do want to use secure boot and TPM2 (I do, currently). Just not with windows

You can.

just disable device guard.

> Why should be secure boot windows exclusive feature?

you are angry about the wrong thing

device guard and secure boot are different things, related, but different.


It is not a solution, it is a bad workaround.

> device guard and secure boot are different things, related, but different.

The problem is that it can have potentially catastrophic impact. If the user enabled Bitlocker, and didn't save recovery key (it will happen for mainstream users), he can lose his windows drive when he tries linux.

As I wrote above, another extra-hop for those who would like to go off the beaten windows path.


> It is not a solution, it is a bad workaround.

it's a configuration option.

it's a bad workaround for you.

I disagree.

> If the user enabled Bitlocker, and didn't save recovery key

then the user is responsible of being incautious.

case closed.


> then the user is responsible of being incautious.

Congratulation, you just invalidated the entire raison d'etre of both Secure Boot and this new Device Guard.


So they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing).

The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.


> The default for years was to boot from external storage, when the internal is not bootable

Not on my computers for the past 20 years.

If the default is not bootable a “no bootable device found” message appears.

computers should never automatically boot from external storage, unless the user wants to.


For devices that I've bought in the last ~10 years (i.e. coming with UEFI, between Thinkpad T430s in 2012 and NUC11 few weeks ago), the default was:

- try to boot the internal devices

- then try external (some even distinguish optical and key fobs)

- then try PXE

and only when all of these fail, message the user "no bootable device found".


I remember some desktop computers did, but it was when external boot devices where CD-ROM

And even then this message appeared

Press any key to boot from CD...

https://i.imgur.com/VyZOuob.png


That's a message from the Windows installer. Normally you would have to remove the optical disc after the files are copied or change the boot order/devices when the first stage of the installation ends and the computer is rebooted. With this trick, you don't have to do anything.


It is legacy boot, not UEFI. And I vaguely remember that this message came from the boot loader on the CD, of all places. It was a convenience for the user, who forgot the CD in the drive.


> It was a convenience for the user, who forgot the CD in the drive.

because computers should never automatically boot from external or removable storage

that's why a more modern version of the same message exists

https://i.imgur.com/JVW8c7b.png


This is what I'm getting: https://imgur.com/a/C7NNXCr

It won't boot from USB if the internal drive boots, or unless I manually change boot order.


A former work computer of mine (a Lenovo, too!) wouldn't boot one day. After some time trying to figure out the issue I discovered I'd left a (non-bootable) USB drive attached to the machine. Removed the drive and it booted fine.

Having said all that, this comment is all anecdotal, much like yours.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: