Slashdot Mirror
Dual Boot Not Trusted, Rejected By Vista SP1
Alsee writes "Welcome to our first real taste of Trusted Computing: With Vista Enterprise and Vista Ultimate, Service Pack 1 refuses to install on dual boot systems. Trusted Computing is one of the many things that got cut from Vista, but traces of it remain in BitLocker, and that is the problem. The Service Pack patch to your system will invalidate your Trust chain if you are not running the Microsoft-approved Microsoft-trusted boot loader, or if you make other similar unapproved modifications to your system.
The Trust chip (the TPM) will then refuse to give you your key to unlock your own hard drive. If you are not running BitLocker then a workaround is available: Switch back to Microsoft's Vista-only boot mode, install the Service Pack, then reapply your dual boot loader. If you are running BitLocker, or if Microsoft resumes implementing Trusted Computing, then you are S.O.L."
What happens on systems without a TPM?
Does one of the more popular Vista cracks not rely on booting Grub4Dos to load a bit of code to patch the kernel after boot?
I am thinking this will be affect the crack.
Before anyone says it, no, I am not running a pirate version of Vista, so I cannot check. In fact... not running any version of Vista, joy!
Has anyone tried this with Boot Camp? I had no problems with Mac OS X and FileVault dual-booting with either XP SP2 or Vista base.
If you are using BitLocker then you want your data to be secure. There are probably ways that a compromised boot loader can allow an attacker access to your data. Vista closes this security hole by requiring the boot loader to be a cryptographically signed binary that it trusts. If it didn't, this story would instead be "Vista BitLocker encryption not secure on dual boot systems".
That being said, there should be a way to register other trusted signature keys in Vista to allow 3rd party boot loaders. I don't know if there is or not, but there should be.
Comment removed based on user account deletion
Is there really any need to choose between operating systems at boot time on a single box any more?
Let me rephrase that question:
If there wasn't a need for multi-boot systems, why do so many of us have that arrangement? My answer might be special hardware not supported by virtualization, like TV capture cards... In addition, there IS a performance hit using virtualization; loading each OS on their lonesome allows for maximum resource availability.
That, of course, is my humble opinion.
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
I'm confuse why anyone would dual-boot Vista. Dual booting Windows to have a game machine is simply practical, but Vista sucks vs XP as a game platform - it's slower and takes far more resources to run at all (and if you didn't have resource limits, you'd just have 2 boxes). Why would you do this?
Socialism: a lie told by totalitarians and believed by fools.
Does anyone else remember when Quicken a few years ago would overwrite the MBR or something like that, and break dual-boot systems?
What would that do in this case? Brick windows until reinstall?
I thought it was bad of Microsoft to intentionally not read Mac floppy disks. I feel the dual-boot issues (minus BitLocker security issues in this specific case) with windows and linux (or any other OS) are just another example of that same mentality: Make it difficult to work with other systems, to try and keep people locked into the MS trash can for as long as possible.
Don't steal. The government hates competition.
Native hardware support. You can't use specialized hardware (like tuner cards, but there are others). In particular, you can't use 3D acceleration at all unless you fork over for VMWare, and at that it's nowhere near perfect.
"I think an etch-a-sketch with an ethernet port would beat IE7 in web standards compliance."
(I, however, use the Windows boot loader.)
All of that was all arbitrary "fuck-you" coding style anyways, and it should have been written flexibly from the start, like Grub.
Why would a company that makes it's bread and butter off it's operating system take time to code support for alternative operating system's in their boot loader??? The fact of the matter is as a prior post pointed out simply use the windows boot loader can make things much easier. Boot.ini is right there a C:\
On the Oregon Cost born and raised, On the beach is where I spent most of my days
Exactly. I see nothing wrong with third-party boot loaders not being trusted by Vista/TPM by default. If nothing else, the system has no way of knowing if you installed them yourself or if they're part of some sort of root kit. What I don't like is that there isn't a way for the person who owns the computer to override this. As several other posters have commented, this just shows that "trusted" means "trusted by Microsoft not to let users do anything except what Microsoft wants them to."
Good, inexpensive web hosting
...dual boot Vista Ultimate 32-bit/OpenSUSE dev box at the office, I've got SP1 installed and haven't had to touch my bootloader (which works just fine by the way) and Vista works fine as well (in other words it works the same as before ;)...) I thought I was missing something so I read the actual article and it claims (unless I did miss something) that the problem occurs whether you use Bitlocker or not.
Loading...
Many desktop motherboards give the option of booting from specific hard drives. That's the option I use. I install the OS on a hard drive as if it were the only OS, then choose the hard drive while booting up. The downside is, I have to remember which of my 3 drives has which OS.
Is that the whole security premise of "trusted bootchain" is wrong.
Granted, that's one way of infecting a machine. But we haven't seen BIOS bootsector-type viruses since the 80's. Why would you write a bootsector virus when you can just crack the host OS?
Vista is huge, and having a secure bootchain won't change the fact that it's probably riddled with security holes anyway. Someone able to reverse engineer the checksumming code can simply modify the checksummer so that the bootchain always passes validation. What is to stop virus running with administrative user priveledges from modifying this key system binary (probably a DLL, at that!) under the auspices of a "system update"?
So what you get is an OS which can be modified to report that it is secure, when in fact it is not. This is the whole problem with the "trusted computing" initiative - others - presumably media companies - are trusting your machine to tell them that it is secure. It's a broken security model from the outset - who's to say you aren't running Windows in a virtual machine? - and only inconveniences the users.
The society for a thought-free internet welcomes you.
Because their customers want them to.
Using the Windows boot loader to chainload code off another partition is, AFAIK, impossible.
Besides, in Vista the nice, easy-to-modify boot.ini file is gone. It is replaced by yet another binary registry-like database. Typical Microsoft.
Trusted !=Trustworthy. In the intelligence community, a "Trusted Party" is a party that knows enough to backstab you. That is all "Trusted Computing" implies.
Our lab technicians were upgrading vISTA PC's to use the department's standard linux build. For whatever reason, the BIOS wouldn't allow the LINUX install DVD to BOOT. So they had to remove the hard disk drives out of the PC's with built-in TRUSTED SECURITY BIOS'S, pop them into an older untrusted XP system, and then install the linux build and put the hard disk drive pack in again. IT's a pain, but if OS vendors are going to install security measures without consulting their users, this is what is going to happen. Everyone is going to think of ways of getting around these "security measures".
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
"as the hardware want to trust a specific bit of code (e.g. the linux boot loader) then I should be able to manually sign it somehow"
Correct me if I'm wrong but I think if Microsoft is implementing trusted computing in order to implement DRM, to prevent pirating, then it would be by design to prevent users from signing or trusting any software on their own. If they allow to sign arbitrary software and run it on a trusted computer the whole point of the DRM part of trusted computing is defeated and the BSA, MPAA and RIAA get mad. There is a big difference between the motivations Stallman has in signing things and Microsoft and its corporate partners have in signing things.
@de_machina
The old way was to boot linux from a floppy. Confused users were able to grasp the concept that if the floppy was in it would start in linux and out it would start in MS Windows. Can't this concept be reapplied and just set the BIOS to boot from a USB stick and put the bootloader on there?
Vista wouldn't reinstall from OEM discs on my Dell notebook, because I was running GRUB?? That just about gold-plates my hunch. Now, Vista won't run on ANY computer I own because Ubuntu 8.04 is my operating system of choice. It simply does not pay to trust an OS whose future operation is subject to policy whims and random paranoid vagaries by a third party, in this case, Microsoft. I would be happy to join any class action lawsuit that result from this disclosure, but no inducement is sufficient to make me trust Vista again.
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
I once soldered together a system using a (keyed) switch with enough contacts to allow me to effectively swap the master and slave jumpers on two hard drives. (The key part helps because you'd only want to do it when the system was powered off!) But the end result is dual booting between two dedicated hard disks, that aught to stump vista!
If you don't risk failure you don't risk success.
It is time to take note that Red Hat, SuSe and Ubuntu are still using legacy GRUB since the new GRUB 2 does not seem to be ready for prime time.
Legacy GRUB is not being developed any longer, even patches are not accepted. The project had no developers working on it for the past 3-4 years. The major distros have just forked it without saying so. And it is a company fork, each distro has its own conconction.
QUOTE: GRUB Legacy has become unmaintainable, due to messy code and design failures. :UNQUOTE
Who said that? Not Microsoft, check here: http://www.gnu.org/software/grub/grub-2-faq.en.html
Correct me if I'm wrong but I think if Microsoft is implementing trusted computing in order to implement DRM, to prevent pirating, then it would be by design to prevent users from signing or trusting any software on their own.
I'd say their trusted computing scheme puts bit locker and encryption are far higher up on their list than preventing piracy.
If they allow to sign arbitrary software and run it on a trusted computer the whole point of the DRM part of trusted computing is defeated and the BSA, MPAA and RIAA get mad.
Ah... no. Not at all. The two aren't actually in conflict. Suppose the MPAA demands a 'trusted path' and requires all drivers to be approved by them before they'll show their precious HD movie. Microsoft with their trusted computing systems has enabled that.
But if I were able to self-sign a driver, so that my copy of vista would accept it as ok to run while driver signing was enabled, what would that do to defeat the MPAA's 'DRM'? Nothing at all!! Because the MPAA doesn't trust my signature, so even though the code is signed by me, its not signed by THEM, so as long as I'm running 'vux984's video driver', the system won't play their content, and its safe from my 'untrusted' (by them) driver.
There is no conflict here!!
1) I can run anything I trust on my computer.
2) If I want to play -their- content, I'd to provide a system -they- trust.
We are already seeing the beginning of this outside of the 'trusted computing' systems...for example already some games won't run if they detect certain other programs running -- like debuggers, virtual CD rom systems, known cheat programs, etc.
And its been a fairly peaceful co-existence... its not like they don't allow us to run debuggers and whatnot... just not at the same time as their software. The same sort of situation could arise with drivers... especially if we get to the point where we can reliably load and unload more of them on the fly.
There is a big difference between the motivations Stallman has in signing things and Microsoft and its corporate partners have in signing things.
Microsoft is certainly aiming to accomodate its corporate partners, but there's actually no conflict to including accomodating the stallman's of the world too.
Well, you say that, but it's a jolly sweeping statement. I want exactly that, and this system is not built to permit it. I develop for Solaris, but use corporate tools on Windows.
Takes me back to the old days when you couldn't install Windows without it dumbly overwriting the MBR and screwing your Linux boot process. Anyone would think that MS don't want you dual booting, and write their software not necessarily to make it harder, but certainly with no interest in making it easier!
Now, remind me, who is trusting and what is trusted? Clearly I am not trusted to decide to if I want to dual boot, whether I am a network admin or not.
Justin.
You're only jealous cos the little penguins are talking to me.
...that "good enough for government work" used to mean that the work was really good. Kinda funny if it's true.
One last thing: Sometimes I wonder; "Is that someone's signature? Or do they type that at the end of each post?"
Perhaps you are missing part of the picture too.
As a network admin administrating machines for a non-technical user base, then yes as the nominal 'owner' (as in person responsible for) of the machines , you want to be able to prevent non-technical users from doing nasty things like altering the boot sector or installing untrusted (as in not trusted by you) software.
However, this system changes that. Even though you are the nominated owner (as in person who is responsible for the machines), you no longer have control over what is or is not trusted.
So if in a couple of years time, you decided that you wanted to change the software or OS running on the machines you are responsible for .... you can't.
The choice is no longer yours.
This isn't a question about what users can do, it is about what owners can do.
For many of the people on SlashDot, owner and user are the same person. I own, and am responsible for, my desktop machine.
In a business environment, owner and user may be different people, but the issue is the same.
The person who is responsible for the machine should have full control of the machine, not the 3rd party that supplied the OS.
As the owner (as in person who is responsible for the machines), you may choose to accept the default settings supplied by OS, but you should have that choice.
Otherwise, you are not the owner any more, you just become another user, albeit one step up in the food chain.