Dual Boot Not Trusted, Rejected By Vista SP1

Alsee writes "Welcome to our first real taste of Trusted Computing: With Vista Enterprise and Vista Ultimate, Service Pack 1 refuses to install on dual boot systems. Trusted Computing is one of the many things that got cut from Vista, but traces of it remain in BitLocker, and that is the problem. The Service Pack patch to your system will invalidate your Trust chain if you are not running the Microsoft-approved Microsoft-trusted boot loader, or if you make other similar unapproved modifications to your system. The Trust chip (the TPM) will then refuse to give you your key to unlock your own hard drive. If you are not running BitLocker then a workaround is available: Switch back to Microsoft's Vista-only boot mode, install the Service Pack, then reapply your dual boot loader. If you are running BitLocker, or if Microsoft resumes implementing Trusted Computing, then you are S.O.L."

Comments

But what if...

[ivan256]

What happens on systems without a TPM?

Re:But what if...

[Sancho]

Not at all true. Security isn't binary. Bitlocker alone will stop 99% of attackers who try to get at your data through physical access. The rest probably won't bother with a trojan bootloader--they'll either use rubber hose cryptanalysis or a hardware keylogger, depending upon how stealthy they want to be.

I don't see a problem with Bitlocker using TPM in this way at all. But it should allow me to disable the bootloader check if I so choose.

Re:But what if...

[sweet_petunias_full_]

Or it could just be a subtle, intentional way of censoring what somebody considers a really sensitive topic. The way it works is that first page of the posts are basically offtopic throwaway posts that get modded up by the gatekeepers to force any ontopic comments (if any) into the second page. Thus, any noobs or stray readers will not even find out why anyone would care about the topic, will be distracted by what seems a stupid, nonsensical discussion and go read something else. Thus, the extent of any negative public reaction is effectively controlled.

Affects crack?

[0xygen]

Does one of the more popular Vista cracks not rely on booting Grub4Dos to load a bit of code to patch the kernel after boot?

I am thinking this will be affect the crack.

Before anyone says it, no, I am not running a pirate version of Vista, so I cannot check. In fact... not running any version of Vista, joy!

Vista and Mac OS?

[TheMidnight]

Has anyone tried this with Boot Camp? I had no problems with Mac OS X and FileVault dual-booting with either XP SP2 or Vista base.

Not trusted for a reason

[naoursla]

If you are using BitLocker then you want your data to be secure. There are probably ways that a compromised boot loader can allow an attacker access to your data. Vista closes this security hole by requiring the boot loader to be a cryptographically signed binary that it trusts. If it didn't, this story would instead be "Vista BitLocker encryption not secure on dual boot systems".

That being said, there should be a way to register other trusted signature keys in Vista to allow 3rd party boot loaders. I don't know if there is or not, but there should be.

Comment removed

[account_deleted]

Comment removed based on user account deletion

And what if another Quicken fiasco?

[coldmist]

Does anyone else remember when Quicken a few years ago would overwrite the MBR or something like that, and break dual-boot systems?

What would that do in this case? Brick windows until reinstall?

I thought it was bad of Microsoft to intentionally not read Mac floppy disks. I feel the dual-boot issues (minus BitLocker security issues in this specific case) with windows and linux (or any other OS) are just another example of that same mentality: Make it difficult to work with other systems, to try and keep people locked into the MS trash can for as long as possible.

Re:Only a problem if you have TPM?

[Ferzerp]

(I, however, use the Windows boot loader.)

Re:How is this news?

[techno-vampire]

The ONLY flaw I see in the entire Vista/TPM system is that users don't seem to have a way of manually trusting things they genuinely want to trust. If it hasn't been blessed by MS its not trusted...

Exactly. I see nothing wrong with third-party boot loaders not being trusted by Vista/TPM by default. If nothing else, the system has no way of knowing if you installed them yourself or if they're part of some sort of root kit. What I don't like is that there isn't a way for the person who owns the computer to override this. As several other posters have commented, this just shows that "trusted" means "trusted by Microsoft not to let users do anything except what Microsoft wants them to."

Re:You can use the Vista boot loader

[ashayh]

Many desktop motherboards give the option of booting from specific hard drives. That's the option I use. I install the OS on a hard drive as if it were the only OS, then choose the hard drive while booting up. The downside is, I have to remember which of my 3 drives has which OS.

Re:You can use the Vista boot loader

[cortana]

Because their customers want them to.

Using the Windows boot loader to chainload code off another partition is, AFAIK, impossible.

Besides, in Vista the nice, easy-to-modify boot.ini file is gone. It is replaced by yet another binary registry-like database. Typical Microsoft.

Re:Only a problem if you have TPM?

[Chrontius]

Trusted !=Trustworthy. In the intelligence community, a "Trusted Party" is a party that knows enough to backstab you. That is all "Trusted Computing" implies.

Re:Except that...

[mikael]

Our lab technicians were upgrading vISTA PC's to use the department's standard linux build. For whatever reason, the BIOS wouldn't allow the LINUX install DVD to BOOT. So they had to remove the hard disk drives out of the PC's with built-in TRUSTED SECURITY BIOS'S, pop them into an older untrusted XP system, and then install the linux build and put the hard disk drive pack in again. IT's a pain, but if OS vendors are going to install security measures without consulting their users, this is what is going to happen. Everyone is going to think of ways of getting around these "security measures".