Windows 8 Secure Boot Defeated

jhigh writes "An Austrian security researcher is scheduled to release the first 'bootkit' for Windows 8 at the upcoming MalCon in Mumbai. This exploit loads in the MBR and stays memory resident until Windows loads, resulting in root access to the system. This allegedly defeats the new secure boot features in Windows 8's bootloader."

Comments

Could open your system up to malware like Linux

[elrous0]

But if the Windows bootloader integrity is compromised, we could all end up infected with Ubuntu, Debian, FreeBSD--god only knows what!

Won't someone PLEASE think of the children?!?!?

Re:Could open your system up to malware like Linux

[Anonymous Coward]

That's what Edubuntu's for.

Re:Could open your system up to malware like Linux

[liquidweaver]

Someone has thought of the kids!! http://maketecheasier.com/doudoulinux-a-fun-linux-distro-for-kids/2010/11/26

Re:Could open your system up to malware like Linux

[Talderas]

dou dou linux?

Naming a flavor of linux after shit?

Re:Could open your system up to malware like Linux

[c 0xFF]

Actually, it refers to a teddy bear. Kinda cute, with unfortunate implications to the American ear.

Re:Could open your system up to malware like Linux

[Anonymous Coward]

Or just some nice rootkits...

Re:Could open your system up to malware like Linux

[goffster]

The kids are alright.

Re:Could open your system up to malware like Linux

[Anonymous Coward]

Doudou is the French for comforter; a child favorite blanket, teddy bear or a scarf.

Re:Could open your system up to malware like Linux

[Anonymous Coward]

"Won't someone PLEASE think of the children?!?!?"

I laughed out loud and work and everyone is wondering why.

Re:Could open your system up to malware like Linux

[Anonymous Coward]

Say what you like about Microsoft, but one thing you can't deny is that Microsoft uses reputation management software to create multiple fake social media profiles.

Many of them are used to moderate and influence discussion in tech sites like Slashdot.

Re:Could open your system up to malware like Linux

[mangu]

Some teddy bears have even worse implications...

Re:Could open your system up to malware like Linux

[phorm]

Besides, to kids, "doo doo" is probably fun/amusing.

Re:Could open your system up to malware like Linux

[hairyfeet]

Actually it doesn't have a damned thing to do with linux and everything to do with pirates. if you look on any BT site you'll find "Windows 7 all versions pre activated" which passes WGA and has for nearly two years. it does this by running a bootloader that fakes an OEM signature so MSFT would have to kill the keys for the major OEMs thus causing more than a little shitstorm from all those that bought win 7 PCs and suddenly were told they are pirates.

So despite all the bullshit from MSFT that it was about security, and despite all the FOSSies screaming "Its a plot to kill Linux!" in actuality it was just MSFT playing whack a mole with the pirates and yet again losing.

. The sad part was they HAD the cure for piracy in the west, I saw with my own two eyes as many pirates which had NEVER paid for Windows suddenly were running legit. i'm of course talking about the Win 7 HP $50 upgrade. When they killed that suddenly the local CL was filled with $100 PCs with $300 Windows installs. Just more proof Ballmer is as shitty a CEO as the Pepsi guy was for Apple.

Re:Could open your system up to malware like Linux

[denyAll]

I put this on a thumb drive that my daughter boots to an old laptop of mine. She loves it.

Secure boot is UEFI

[Anonymous Coward]

Secure Boot is a UEFI feature, not Windows one. The article makes no reference to UEFI whatsoever - and it offers no explanation either for what mechanic was actually defeated. I do doubt the integrity of the article ARS is using.

Re:Secure boot is UEFI

[Anonymous Coward]

>>I do doubt the integrity of the article ARS is using.

Are you suggesting that ARS was compromised?

Re:Secure boot is UEFI

[makomk]

Secure Boot is a Windows feature building on a UEFI feature. If I'm understanding it correctly, every stage in the chain needs to be secure in order for the boot to actually be secure - a security flaw in either the UEFI firmware or the Windows code could render it ineffective.

Re:Secure boot is UEFI

[Anomalyst]

a security flaw in either the UEFI firmware or the Windows code could render it ineffective.

Let's get real, what are the odds of a flaw in Windows code?

Re:Secure boot is UEFI

[cvtan]

No. They just got it ARS backwards.

Re:Secure boot is UEFI

[afidel]

You are correct, this is just an update of his previous exploit against other Windows versions, it only works with legacy BIOS, not against EUFI with secure boot. The story over at ARS has been updated.

Re:Secure boot is UEFI

[SuricouRaven]

Actually the keys are controlled by the OEM, or the motherboard manufacturer. In theory, they have the choice of which operating systems to allow. In practice, people aren't inclined to trust the OEMs. Most of whom don't like to acknowledge linux exists.

Re:Secure boot is UEFI

[0123456]

Don't forget DRM: this way Microsoft can ensure that you can't install drivers or other software that can break the DRM system. Only a signed OS runs, only signed drivers run, eventually only signed applications from the Windows App Store run.

Re:Secure boot is UEFI

[cbhacking]

The funny thing is, this kind of thing is exactly the reason *for* Secure Boot (the non-conspiracy one, not the one that Slashdot is typically talking about). If you're using UEFI and you can verify a chain of trust, then you don't have boot sector malware. The fact that boot sector malware is possible on Win8 if you're NOT USING UEFI (because you're using an MBR) is not only obvious, it's the problem that Secure Boot is supposed to prevent.

I wonder, among the peoople who tagged this "irony", how many actually ahve the right of it. The only irony in the situation is that Slashdot is so rabidly opposed to the idea that a headline which is factually incorrect (blatantly obviously so) is posted because it is compatible with the popular bias, despite having no basis in the technology that we nerds supposedly understand.

That all said, there are certainly valid concerns about Secure Boot. It's entirely possible that they outweigh the value of making malware like this impossible. You should know what you're up against when you argue your case, though.

Re:Secure boot is UEFI

[DJRumpy]

Somewhat. Windows 8 is the first OS from MS to support the UEFI secure boot feature. In that way it's much like the DMA for Blu-Ray, meaning all links in the chain must support it in order for the disc to be legally decrypted (in theory at least..lol).

I've found other references to this rootkit though and apparently the flaw is actually exposed in the legacy BIOS, not in UEFI, or Windows 8.

According to Kleissner the new Windows 8 hack does not attack UEFI ’secure boot’ feature and currently only works on systems running legacy BIOSes.

Ref: http://www.zdnet.com/blog/hardware/security-researcher-creates-windows-8-bootkit/16365

Re:Secure boot is UEFI

[afidel]

I have nothing against secure boot, just like I had nothing against TPM. They are merely tools that allow you to make a computer more secure if you so choose. Unless and until Microsoft completely shuts off significant Windows functionality if you aren't running these technologies then I have nothing against them. I don't want PC's to become glorified XBOX's with a different application set but I also recognize that it's impossible to have a completely secure environment without the help of hardware enforcement.

Re:Secure boot is UEFI

[Tastecicles]

ISTR someone ran some numbers on Windows 95 some years back... in 15 million lines of code, there were (I forget the reported number) several hundred thousand coding errors which ranged from kernel bugs to showstoppers - odds of an error in precompile code actually worked out to about one "showstopper" error every thirteen lines. A lot of them had numbers atttributed to them (MSKB) with workarounds and/or downloadable and/or service packed (or in those days, "OEM service release") patches. For a while between the release of Windows 95 and just before XP was released, I had an MSDN subscription; almost on a weekly basis I received CDs through the door containing the latest batch of across-the-board patches and service releases. I let the subscription lapse because I was starting to drown in MSDN binders...

Re:Secure boot is UEFI

[sgt scrub]

From what I've read, if there is a flaw in the UEFI firmware Windows will not boot.

Re:Secure boot is UEFI

[webnut77]

eventually only signed applications from the Windows App Store run.

+1 Insightful

Re:Secure boot is UEFI

[Anonymous Coward]

Well you really can't assume that people will use their brain when it's about MS in a negative way! No clearly there's a bug in MS's code which also has the magical ability to run before the bootloader.

Re:Secure boot is UEFI

[sjames]

Secure boot is a process. It starts with UEFI, but each link in the chain must maintain security. In this case, the Windows 8 bootloader is the weakest link.

Re:Secure boot is UEFI

[hairyfeet]

You don't have to worry about that, and you can thank your friends at AMD for it! AMD has announced they are going with Coreboot instead of UEFI which i'm sure many here will know is a completely free and open source BIOS replacement that is getting a lot of funding through AMD. This of course means MSFT won't be able to force Windows 8 to be secure boot only as that would keep every AMD CPU from running Win 8 and probably get them another round of antitrust for their trouble.

Personally it has just made me happier that I switched to become an AMD only shop. One of the things that REALLY pisses me off with OEM PCs is getting in there and finding the BIOS is so crippled and short on features it actually hampers the system, like with a customer I had recently that had to toss a stick of RAM simply because the BIOS had no feature to switch between dual and single mode and the board wouldn't read unmatched sticks. But for those of us that stick with AMD it'll mean if you get an OEM and Coreboot doesn't have what you need so what? You can roll your own and just flash the Coreboot with a different version, kinda like CyanogenMod.

Oh and MSFT really can't lock it down to where you can't switch OSes simply because all those fat software assurance and MSDN contracts wouldn't be worth shit. i know quite a few that have those contracts so they can run older versions for critical programs and if MSFT killed it there would go a LOT of SMBs and business is their bread and butter.

No most likely on first boot you'll get a "Did you know you don't have secureboot? Check yes if you wish to disable and absolve MSFT of any responsibility if you get a boot virus" and we'll all go "yes we know now STFU and get out of my face, stupid Windows" and go on about our daily lives, just as we do now.

Re:Secure boot is UEFI

[Anonymous Coward]

You must be an idiot if you think that enterprise shops are going to actually give a flying fuck about the BIOS and attempt to flash it for something else. They'll get pre built machines that Just Work. Those of us with Intel machines have enough money to buy matching sticks of RAM, too.

Re:Secure boot is UEFI

[GigaplexNZ]

Secure boot is a process. It starts with UEFI, but each link in the chain must maintain security. In this case, the Windows 8 bootloader is the weakest link.

No, in this case they got it completely wrong and 'defeated' the already vulnerable legacy BIOS/MBR - UEFI wasn't involved at all.

Re:Secure boot is UEFI

[afidel]

Actually, back when I bought my DL585 I could have used the ability to fix the BIOS myself, boot from SAN was listed as a feature but it didn't work for the first few months I owned it due to a BIOS bug. We ended up having to buy a pair of drives to put the OS on which also meant we couldn't remotely boot the development database server with the production OS image like we could later servers (came in handy when we lost a prod server over the weekend with 2' of snow on the roads, just map the OS LUN to the development HBA's and use iLo to power cycle the machine).

Re:Secure boot is UEFI

[somebody1]

The bootloader being open source does not in any way mean that it cannot implement secure booting. If it refuses to boot an unsigned OS and if it refuses to replace itself with an unsigned image (that's typical for secure bootloaders) then you are stuck looking for vulnerabilities or replacing the chip just like with a closed bootloader.

Re:Secure boot is UEFI

[bzipitidoo]

And why is it people, even highly technical people don't have the right of it? Because Microsoft and friends persist in calling 2 very different things by the same name. To hear them tell it, "security" is both security against malware, and malware in the form of "security" against piracy of their products, also known as DRM. They spin it out of all recognition when they make the absurd claim that the DRM is for your own good, that it "protects" you from piracy. Yeah, just like the Mafia protects their customers from crime.

Until MS changes their tune, and stops trying to push baloney, they deserve spirited opposition. It's not rabid at all to call out anyone for that kind of garbage. MS has pulled whopper after whopper for years. OOXML and MS Office file format lock in, Windows Vista's extreme DRM, Windows XP's phone home, J, IE, asserting patents on DOS FAT, the Microsoft tax (on CPUs), trying to kill off Ogg Vorbis. This is more of the same. They can't just let a secure boot system do its job, they've got to screw it up with DRM. How can you continue to excuse MS, be a MS apologist? Are we so accustomed to outright criminal behavior from big corporations that we hardly notice anymore?

Re:Secure boot is UEFI

[shutdown -p now]

This of course means MSFT won't be able to force Windows 8 to be secure boot only as that would keep every AMD CPU from running Win 8

As noted by GGP, Win8 is not "secure boot only". It will boot on any hardware that boots Win7 today. Secure boot is only a requirement for that "Designed for Windows" sticker that OEMs slap onto their hardware.

By the way, there's nothing at your link saying that AMD is going with coreboot instead of UEFI. In fact, that specific story is posted under "embedded systems"... wonder why?

And I very much doubt it would be an antitrust issue. UEFI is an open specification, so everyone is free to implement it.

Re:Secure boot is UEFI

[shutdown -p now]

You are free to buy non-UEFI hardware, or the one on which Secure Boot can be disabled or have custom keys installed, and install Win8 on it (or use any existing hardware, for that matter).

Re:Secure boot is UEFI

[Anonymous Coward]

How will Windows know when a flaw is found.

Or are you saying that it will never boot, because any software bigger than Hello World, will always have flaws?

Re:Secure boot is UEFI

[_Shad0w_]

Foruntatly MSDN went downloads prefered some time ago. It may even be downloads required by now.

Re:Secure boot is UEFI

[hairyfeet]

Didn't bother to read the entire FL did you? It was under embedded because they had just released their latest Coreboot for an embedded system but if you'll read about the middle of the page he says " Finally, AMD is now committed to support coreboot for all future products on the roadmap starting next with support for the upcoming Llano APU. AMD has come to realize that coreboot is useful in a myriad of applications and markets, even beyond what was originally considered". Now since Llano isn't an embedded but a mainstream laptop chip I doubt they are talking about embedded, don't you?

And I would say it would very much be an antitrust issue if the ONLY machines that can get a "designed for Windows" sticker belongs to Intel. And considering Intel has more than one investigation ongoing I doubt they'd want the attention either. If the reports are correct the ONLY way one will be able to get the DFW sticker would be to have secureboot AND have it active. Now since as I just linked to that would be cutting out the FOSS bootloader AND cutting out any AMD PC from carrying the sticker I think the EU might want to have a word with them about their approach. Its just a damned shame our DoJ hasn't got any teeth anymore, hell if the MSFT trial happened today not only would MSFT win they'd probably get a tax break and an apology!

Re:Secure boot is UEFI

[shutdown -p now]

Finally, AMD is now committed to support coreboot for all future products on the roadmap starting next with support for the upcoming Llano APU.

My understanding is that "support" here means "it'll work with coreboot", not "we'll ship it with coreboot".

And I would say it would very much be an antitrust issue if the ONLY machines that can get a "designed for Windows" sticker belongs to Intel.

If it happens because AMD refuses to implement an open specification for no cost, I doubt they'd have a serious case. Anti-trust is when you actually place a barrier against someone's entry to the market. When you leave the door wide open, but they refuse to go in for some other reason, they don't get to cry "monopoly!" if they miss on a deal they knew was going on inside because of that.

Now since as I just linked to that would be cutting out the FOSS bootloader

I don't think there's anything in the terms that prohibits a FOSS UEFI implementation, provided that it implements Secure Boot (which, so far as I can see, is quite possible to do, even with GPL'd code).

"Cutting out" a specific piece of FOSS code because it does not implement an (open) protocol - again, doesn't seem like there's any standing for anti-trust here. It would be a different thing if the protocol in question was completely locked down such that it's impossible to implement by a third-party without licensing.

Re:Secure boot is UEFI

[Tastecicles]

yep, it was around the time XP went Gold. I didn't have the money then to upgrade from my 8GB hard disk... holy fuck, what happened? I remember when the only reason to upgrade *to* 8GB was to fit more music and CD burners were still £300 (8GB drives were £140... 15GB killed you for £400 and 30GB was a pipe dream)!

Re:Secure boot is UEFI

[_Shad0w_]

My first HDD was on my Atari ST, it was 20MB and, I think, cost over £400 at the time. It was also in a case big enough to use as a monitor stand - this was mostly because it had a PSU, interface adaptor, and the actual HDD in.

I can't remember what type of drive they actually used; I think they were SCSI-1, but you needed the adaptor board because the ACSI protocol was a SCSI derivative, not actual SCSI (IDE didn't even exist at the time).

I remember the old HDDs didn't play well with the STE when it came out - my dad kludged it so it would work again (two pins needed shorting on start up, so he put a micro switch on a couple of pieces of cable on the relevant pins).

Re:Secure boot is UEFI

[Tastecicles]

my first hard drive (Winchester 10MB) came wrapped in a 286 cabinet which also had a stonking 2MB of RAM and DOS 5.

Sadly, I no longer have the 286.

Even more sadly, I still have the Winchester. Installed on my museum board (Dell Dimension XPS P60. With an actual, still functioning Intel Pentium mark I 60MHz installed on it).

Sadder still, it still spins.

Re:Secure boot is UEFI

[_Shad0w_]

Had a bloody great Winchester in our 286. By bloody great I mean "it took up two 5.25" slots on the front of the PC", back when drives still had front plates because you actually mounted them where you could see them. Forget what the capacity was, might have made it to 120MB or something similar. Made a great door stop in its retirement :)

My old 286 board, that used SIPP expanded memory, is long gone, alas :( Seem to remember it actually had all the base memory slots populated to actually take it up to 512KB of base memory.

Re:Secure boot is UEFI

[harryjohnston]

From coreboot.org: "coreboot can scale from specialized applications that run directly from firmware, run operating systems in flash, load custom bootloaders, or implement firmware standards, like PC BIOS services or UEFI."

Back that Boot-y up

[dasherjan]

Hurray?

Horray!

[Tyrannosaur]

Finally a jailbreak for the desktop! I was tired of using locked-down hardware! I will now run a jailbroken desktop exclusively.

Re:Horray!

[Anonymous Coward]

Yeah but the heydays are over the next time you run Windows Update. Be Aware!

Re:Horray!

[Anonymous Coward]

Seems like I've heard all this before..... Something about those phones I ignore.

Now i guess this will be forced down my throat along with more government required shit.

You *know* they have been leaning the FBI/CIA/ETC on Microsoft. I mean come on they have special rooms at AT&T just for monitoring but somehow *nothing* at all in the OS? Nothing now? Really???

I just don't trust it. Vulnerabilities are those paid backdoors. They just pretend it's a fuckup if one of the real backdoors is found in the midst of their numerous bugs.

Sad world we live in.

Re:Horray!

[Anthony Mouse]

Yeah but the heydays are over the next time you run Windows Update.

So...don't?

1) Install vulnerable Windows.
2) Install Linux, then delete all the bits of Windows not needed to boot Linux.
3) Run Windows in a VM, if at all.

Re:Horray!

[SuricouRaven]

This defeats one of the advantages of linux: It's free. As in beer. Companies and individuals alike approve of free - why should they spend money on something expensive if the free software is equally capable? If you have any part of Windows on the system though you'd need a Windows license.

Re:Horray!

[Anthony Mouse]

That's technically true, but what kind of machine is going to come with mandatory secure boot and not also come with a Windows license? Or, to put it a different way, if you're specifically buying a machine that doesn't come with a Windows license then you can easily just get one that doesn't come with secure boot.

The problem with secure boot is that it prevents people from converting older machines. You get a Windows machine, then later discover Linux and want to install it, and you can't because of secure boot. But in that case you already have the Windows license; it doesn't cost anything more.

There is a certain degree of bogosity here though. The preceding is based on the assumption that secure boot doesn't actually work: If you can root Windows, boot Linux and then run Windows in a VM, so can malware. And if that's the case then secure boot just shouldn't exist, because it's worse than useless. It doesn't stop malware and it makes it annoying to run Linux.

Whereas if it does work (and you can't turn it off) then it stops you from running Linux, which is an even more serious problem.

Windows or UEFI?

[dreemernj]

Is this an exploit of Windows or of UEFI in general?

Re:Windows or UEFI?

[bryan1945]

From what I've read, it's a Windows thing. No mention of UEFI in the article. But TFA is so slim on details... yada yada

Re:Windows or UEFI?

[Anonymous Coward]

Neither. From the article, it appears to exploit legacy BIOS which is pointless. Secure boot is meaningless without UEFI.

Re:Windows or UEFI?

[Anonymous Coward]

Neither. The article is a beat-up, and fundamentally wrong. Secure Boot requires UEFI, and this exploit doesn't break UEFI (it uses MBR).

UEFI doesn't have MBR

[Manip]

Uhh UEFI literally has no MBR, it doesn't exist. So please explain to me how this exploit functions when the MBR doesn't exist? I think he is booting his drives in the wrong mode, which is to say legacy MBR mode instead of ADAPI/UEFI mode.

Re:UEFI doesn't have MBR

[Amouth]

Agreed - that's my first question.. looks like they "defeated" secure boot by not using it to start with.

Re:UEFI doesn't have MBR

[BlackSnake112]

Plus it looks like it needs physical access to the machine. If you have physical access you can boot it anyway you want. If this was a remote hack I would be more impressed.

Re:UEFI doesn't have MBR

[Anonymous Coward]

Wrong. The whole point of secure boot is that you will only be able to boot "approved" OSes. For high end or whitebox machines there will be a way to "approve" OSes yourself or turn secure boot off entirely but the ones you find in major stores probably won't have that option.

Re:UEFI doesn't have MBR

[Anonymous Coward]

But the point of UEFI is that you _might not_ be able to boot it any way you want.

Re:UEFI doesn't have MBR

[operagost]

Also works for the WOPR technology.

Re:UEFI doesn't have MBR

[Anonymous Coward]

For high end or whitebox machines there will be a way to "approve" OSes yourself or turn secure boot off entirely but the ones you find in major stores probably won't have that option.

What a load of shit, there is no conceivable reason they would not allow secureboot to be turned off in the bios, if they wanted to stop you from booting other OSes they could have locked down BIOS features decades ago, but they didn't.

Re:UEFI doesn't have MBR

[RightSaidFred99]

Bullshit. It's the other way around. Very few machines will be locked down to prevent alternate OS's from being installed. It's all a bunch of FUD.

Re:UEFI doesn't have MBR

[Anonymous Coward]

It's possible but rather unlikely that a mainstream desktop system would be shipped in a way that didn't allow the owner to choose a different OS.

The point of SecureBoot is to prevent you from running a different/modified OS _without your express knowledge/consent_.

Re:UEFI doesn't have MBR

[Anonymous Coward]

if you use the word BIOS in your message, it proves you have no idea what you are talking about. you used it twice

Re:UEFI doesn't have MBR

[0123456]

It's possible but rather unlikely that a mainstream desktop system would be shipped in a way that didn't allow the owner to choose a different OS.

Why is that unlkely?

You buy a computer with Windows installed and the UEFI won't let it boot any other OS.

Why won't that happen?

What makes you think Microsoft won't offer better terms to companies who refuse to let other operating systems run on their hardware?

Why do you trust these people?

Re:UEFI doesn't have MBR

[utkonos]

It technically does still have an MBR called the Protective Master Boot Record or Protective MBR. This is part of the GUID Parition Table (GPT) standard. This data resides at Logical Block Address 0. So, your statement that "it doesn't exist is false." However, I believe that you are right, that he did not compromise UEFI. The article was not very clear, but he may be saying that he has been able to infect the PMBR of a GPT disk that boots from BIOS. That would make sense to me.

Also, before you decide to flame me for saying that you are incorrect, please read the spec. I know it is behind a form, but you can also read about it on wikipedia.

Re:UEFI doesn't have MBR

[Anonymous Coward]

I'd already be impressed if it boots Windows 8 in secure mode, i.e. Windows *thinks* it is in secure mode, but in actuality it isn't, with no modification of any part of Windows. A UEFI in BIOS-compatible mode, that boots of a regular MBR, then proceeds to present a fake Secure Boot environment to the Windows Boot Loader counts as such. It would be even better to do this inside a VM.

Re:UEFI doesn't have MBR

[Miamicanes]

> What a load of shit, there is no conceivable reason they would not allow secureboot to be turned off in the bios,
> if they wanted to stop you from booting other OSes they could have locked down BIOS features decades ago, but they didn't.

Until someone decides to sell subsidized, ad-supported computers locked down to stop you from installing a different, non-adlocked OS, they slowly come to dominate the market (because normal users don't value an ad-free experience, or at least don't value being able to do things beyond what the creators of the ad-supported environment felt like supporting), and eventually a computer that's unlocked becomes an exotic niche specialty item that's nearly impossible to buy at a store like Best Buy and literally costs 10-20 times as much, partly because it's such an exotic niche item with so little demand. Sure, they'll exist... but you won't just be paying the difference between the cost of the subsidized model and whatever the subsidy is. You'll be getting completely buttfsck'ed and pay *dearly* for the privilege.

Wait, it gets better. A little while later, you'll discover that Windows no longer exists as a standalone retail product, and the only way to officially get it is to buy it with a locked-down factory-built PC. Well, OK... in theory, Windows will still exist as something you can install yourself... if you're an enterprise customer. So, you hunt down a friend who has the benefit of corporate MSDN membership from work, get him to slip you a license and a copy of Windows 17, then go home and install it. And discover that it won't play sound or 97% of the videos you have, because the DRM won't allow it since you're running in an "untrusted" environment. You get mad, successfully re-encode all your media to strip out the DRM, and chalk up a victory against The Man... then realize that Youtube still doesn't work.

It won't happen tomorrow. It won't even happen next year. But rest assured, the pot is full of water, the frog is happily swimming around, and nearly-invisible blue flames are gently caressing the bottom. The day somebody decides to start selling ad-supported PC hardware, pray to ${deity} that Microsoft firmly says, "No", Linus & Stallman have a rare moment of agreement and categorically say it's a GPL violation, and Apple recoils in horror and says "no", too.

Re:UEFI doesn't have MBR

[Anonymous Coward]

if you use the word BIOS in your message, it proves you have no idea what you are talking about. you used it twice

yet the point remains perfectly valid, though for some reason you seem incapable of simply substituting 'UEFI control' in place of 'bios' to see that...poor you.

Re:UEFI doesn't have MBR

[exomondo]

Why is that unlkely?

Because there's no reason to believe it would be done.

You buy a computer with Windows installed and the UEFI won't let it boot any other OS.

Why won't that happen?

Because there's no reason to, and because if MS were involved it would be a clear anti-trust issue, and for the same reason they haven't locked down BIOS features for all these years, they could have done this already but they didn't.

What makes you think Microsoft won't offer better terms to companies who refuse to let other operating systems run on their hardware?

Why do you trust these people?

Better terms to companies for what? And what companies? You think Microsoft is going to pay all manufacturers to lock out competitors and that this is going to be seen as legal in anti-trust law? Nice conspiracy theory, bit too light on any kind of basis though.

Re:UEFI doesn't have MBR

[Anonymous Coward]

That's a good point, except that the PMBR, like you said, is only used to boot from a BIOS. In other words, they would still not be using a UEFI which is required for SecureBoot to work.

Re:UEFI doesn't have MBR

[MadMaverick9]

so when are Microsoft et. al. going to learn their lesson?

a strange game
the only winning move is not to play.

how about a nice game of chess?

Re:UEFI doesn't have MBR

[drsmithy]

Why is that unlkely?

Because it could have been done (much easier, since Microsoft's influence over the hardware vendors was far greater) twenty years ago and wasn't.

Because it's an additional layer of complexity and support for hardware manufacturers and vendors, for little to no benefit.

Because it would fall afoul of the same antitrust law that got them into trouble with per-PC licensing of DOS & Windows in the '80s and '90s.

Why do you trust these people?

I trust hardware vendors to not go out of their way actively preventing sales of their product, for little to no benefit.

Re:UEFI doesn't have MBR

[dragonturtle69]

I hope that you're incorrect. Otherwise, the PC/tablet/slate will become just another consumer media device, like a TV. PC's as they are currently will be like HAM?

Re:UEFI doesn't have MBR

[znerk]

Agreed - that's my first question.. looks like they "defeated" secure boot by not using it to start with.

The part you're missing is "... while making it appear to the OS as if secure boot is enabled and functioning as intended". This is still a defeat of secure boot, just in a roundabout fashion.

Re:UEFI doesn't have MBR

[znerk]

Microsoft has been caught red-handed telling OEMs not to sell machines with operating systems other than Windows pre-installed. What in the world makes you think they would hesitate to require the OEMs to disable the ability to disable secureboot?

Re:UEFI doesn't have MBR

[znerk]

Why is that unlikely?

Because there's no reason to believe it would be done.

Yeah, because Microsoft hasn't been caught threatening OEMs over selling non-Windows equipped PCs... oh, wait.

What makes you think Microsoft won't offer better terms to companies who refuse to let other operating systems run on their hardware?

Why do you trust these people?

Better terms to companies for what? And what companies?

Better terms (or perhaps any terms) for OEMs who wish to sell PCs pre-installed with Windows.

You think Microsoft is going to pay all manufacturers to lock out competitors and that this is going to be seen as legal in anti-trust law?

Yes, Microsoft can, has, and will either pay manufacturers, or threaten and coerce them, to forbid any viable competition in the PC desktop OS market. They've done it before. It has been shown to work. The paltry fines they incur when they get caught indicate that it will continue to work, and the legal aspects simply become a financial aspect to "doing business as usual".

Nice conspiracy theory, bit too light on any kind of basis though.

It's not a conspiracy theory, it's established fact.

Re:UEFI doesn't have MBR

[znerk]

Why is that unlkely?

Because it could have been done (much easier, since Microsoft's influence over the hardware vendors was far greater) twenty years ago and wasn't.

Because it's an additional layer of complexity and support for hardware manufacturers and vendors, for little to no benefit.

Because it would fall afoul of the same antitrust law that got them into trouble with per-PC licensing of DOS & Windows in the '80s and '90s.

Why do you trust these people?

I trust hardware vendors to not go out of their way actively preventing sales of their product, for little to no benefit.

It was done in the past, and it is currently being done. Microsoft has gotten sneakier about not letting anyone in on their little secret, but Microsoft requires OEMs to install Windows as the only OS on any PC with Windows pre-installed.

The hardware vendors don't have an option, because not bending over for Microsoft would (as you put it) "actively prevent sales of their products". If they don't do what Microsoft says, then their license to sell Microsoft products goes away... and Microsoft still owns the vast majority of the market.

Re:UEFI doesn't have MBR

[Amouth]

you could do that with a VM .. but it wouldn't be considered compromising secure boot for UEFI all they did was boon via MBR/BIOS and load a root kit that fooled the OS into thinking it was booted via UEFI and Secure boot.

Now if the OS was orginaly actual booting via UEFI + secure boot and they could do this without having physical access to the box THEN it would be a new story - but this is just someone changing a bios setting and writing a bootloader - whoopdydoo.

Re:UEFI doesn't have MBR

[znerk]

Uhh UEFI literally has no MBR, it doesn't exist. So please explain to me how this exploit functions when the MBR doesn't exist? I think he is booting his drives in the wrong mode, which is to say legacy MBR mode instead of ADAPI/UEFI mode.

I'll explain it quite simply: It's not a UEFI exploit. The trick here is nothing to do with UEFI.

The trick is simply the ability to boot Windows 8 with SecureBoot enabled, and have it happily boot, thinking everything is hunky-dory, without actually having UEFI or its Secure Boot enabled (or even present).

Got it? This exploit fools the Windows 8 security feature called SecureBoot into thinking that it has booted from a secure boot chain, when in reality it not only hasn't done that, but is already rooted.

Re:UEFI doesn't have MBR

[znerk]

this is just someone changing a bios setting and writing a bootloader

.. that is only 14k, and can be loaded via a CD or USB storage device. While disabling password authentication.

Admittedly, the part where physical access to the box is required makes it a bit more difficult to implement, but the fact remains that this is (allegedly) a method of defeating Windows 8's SecureBoot - remote delivery mechanisms can come later. Early versions will require breaking and entering, or social engineering, but this is nothing new to the dedicated IT criminal.

Also, I never stated this had anything to do with breaking UEFI. Nor did the bootkit's author.

Re:UEFI doesn't have MBR

[shutdown -p now]

What makes you think Microsoft won't offer better terms to companies who refuse to let other operating systems run on their hardware?

Because that would lead to an instant antitrust lawsuit, and the last one that happened in EU did not exactly go well (courts over there has this interesting approach towards feet-dragging, where they fine the company, say, a million euro per day until it complies - and then repeatedly double that rate if it still takes too long).

FYI, the total direct cost of EU browser anti-trust case for MS was $3B in fines in court fees. It's pretty big - big enough to show on the yearly report, and attract the negative attention of shareholders and the board.

Re:UEFI doesn't have MBR

[gmueckl]

This is the reason why MS wants to switch to UEFI and its support for signed binaries. That way, the operating system can be reasonably sure that no malicious software was executed before it got control. Having that assurance is actually a good thing. Removing user control over it is not, however.

Re:UEFI doesn't have MBR

[Amouth]

except Secure boot is part of UEFI windows Secure boot relies on the implementation of secure boot in UEFI - if your not using it in UEFI then you where doing it wrong to start with and therefor didn't break anything.

Re:UEFI doesn't have MBR

[Anonymous Coward]

If you want to assert that it is currently being done, you're going to have to come up with something more recent than a 10 year old story.

Re:UEFI doesn't have MBR

[exomondo]

Yeah, because Microsoft hasn't been caught threatening OEMs over selling non-Windows equipped PCs... oh, wait.

Except that since then we've seen the largest computer manufacturers in the world ship Linux-based PCs, Dell did it (and then canned it for lackluster sales), Best Buy tried it as well and even HP have recently announced that all of their desktop PCs will have the ability to run a webOS variant. So nice try, but that's the past, not the present.

Better terms (or perhaps any terms) for OEMs who wish to sell PCs pre-installed with Windows.

So what about all of the motherboard manufacturers, you know the ones who actually control the secureboot feature, you think MS are going to pay off every motherboard manufacturer?

Yes, Microsoft can, has, and will either pay manufacturers, or threaten and coerce them, to forbid any viable competition in the PC desktop OS market. They've done it before. It has been shown to work. The paltry fines they incur when they get caught indicate that it will continue to work, and the legal aspects simply become a financial aspect to "doing business as usual".

That has happened with some major OEMs, but do you actually think they could do such a thing to the entire PC market and then the entire motherboard market?

Re:UEFI doesn't have MBR

[znerk]

Except that since then we've seen the largest computer manufacturers in the world ship Linux-based PCs, Dell did it (and then canned it for lackluster sales), Best Buy tried it as well and even HP have recently announced that all of their desktop PCs will have the ability to run a webOS variant. So nice try, but that's the past, not the present.

Show me a single major PC manufacturer who ships a machine that dual-boots Windows and any non-Microsoft OS.

No, really. Go ahead, I'll wait.

Re:UEFI doesn't have MBR

[exomondo]

Show me a single major PC manufacturer who ships a machine that dual-boots Windows and any non-Microsoft OS.

No, really. Go ahead, I'll wait.

Read what i wrote, i didn't say 'dual-boots', I said 'Linux-based PCs', I also said that they canned the project as in it is no longer running, it's not that hard to read and it's not at all obfuscated so you shouldn't have that much trouble with it. The Dell Ubuntu PCs could dual boot but weren't sold in that configuration, they were sold with just Linux until Dell realized that relatively no-one wanted to buy a PC with Ubuntu pre-installed.

Dell did ship PCs with Ubuntu but dropped it due to it's poor sales performance but they are reportedly bringing it back in the chinese market.

Asus are shipping PCs with Ubuntu Linux as well.

And although they aren't yet, HP have announced plans to include webOS as a boot option on their PCs.

Re:UEFI doesn't have MBR

[harryjohnston]

If you don't trust your hardware manufacturer, buy from someone else. It should also be noted that the mainstream players have already asserted that their products will allow you to turn secure boot off.

Re:UEFI doesn't have MBR

[harryjohnston]

Does Windows even try to determine whether secure boot is enabled or not? What would be the point?

From the "What took so long?" Department....

[apcullen]

This would have been solved sooner if Modern Warfare 3 hadn't been released last week...

Re:From the "What took so long?" Department....

[Anonymous Coward]

That would have been funny if you substituded Modern Warfare out with Skyrim.

Re:From the "What took so long?" Department....

[Anonymous Coward]

More like Skyrim instead of that Activision drivel.

Hey, buttholes, it's MY COMPUTER.

[EmagGeek]

I'm tired of these software vendors thinking that they own the rights to my hardware that I pay for.

Re:Hey, buttholes, it's MY COMPUTER.

[X0563511]

I bet you had a shitfit about the TPM as well. Which happens to have three states, and I'll hilight the interesting ones for you:
1. Active
2. Inactive (just turns off)
3. Disabled (wipes keys)

Hell, and it's Dell letting you change this - hardly a company you'd expect to let you do so.

Re:Hey, buttholes, it's MY COMPUTER.

[mjwx]

Hell, and it's Dell letting you change this - hardly a company you'd expect to let you do so.

Why does this surprise you?

Dell isn't into customer S&M like Apple, they realise that it's _your_ computer not your _Apple_ computer.

Re:Hey, buttholes, it's MY COMPUTER.

[Anonymous Coward]

I am not sure whats worse, the idiocy of the OP's comment or the fact that there are those on slashdot that would mod it up as insightful. Seriously secureboot is NOT A MS TECHNOLOGY. It is a hardware implementation that is vendor neutral and MS has absolutely zero say in whether it is on the hardware and whether it can be enabled or disabled. The only thing MS have said is that for there certification program you need to have secureboot to be win 8 certified. Secureboot is a pretty cool idea that will bring great benefits not just to MS but to linux as well.

I read the headline and...

[Anonymous Coward]

...instantaneously punched both my hands in the air!

Not broken

[BitZtream]

I thought the point to the UEFI secure boot thing was that the UEFI wouldn't boot without the MBR and remainder of the boot blocks being properly digitally signed.

Unless someone broke the digital signature system or found a flaw in the implementation, this sounds more like working as intended.

The article also seems to think that the boot loader is supposed to be encrypted for some silly reason.

Seems pretty clear that the article doesn't understand how it works, so its hard to imagine theres much truth in it. If you tell the UEFI to ignore digital signatures on the boot loader then yes, it has been compromised ... cause you turned it off. Intentionally turning it off doesn't count as breaking it guys, sorry.

If there was a claim of a flaw in the UEFI Secure boot implementation or design, then I'd listen, but the fact that its being called a windows exploit when it occurs before Windows has been started kinda sets off signal flares, ya know?

Re:Not broken

[Anonymous Coward]

What? UEFI doesn't have an MBR. Sounds like YOU don't understand.

Re:Not broken

[exomondo]

I thought the point to the UEFI secure boot thing was that the UEFI wouldn't boot without the MBR and remainder of the boot blocks being properly digitally signed.

More to the point is why are you using an MBR on a UEFI system?

Re:Not broken

[znerk]

The point is not that UEFI was broken - it wasn't.

The point is that SecureBoot can be fooled into thinking it's got a secure boot chain under it, when in actuality it doesn't. thus the headline "Windows 8 Secure Boot Defeated" - this MBR hack does a hand-wavy Jedi-mind-trick and tells Windows that everything is fine, and Windows believes it.

Re:Not broken

[harryjohnston]

Do you have a reference for this?

I think the exploit has nothing to do with secure boot at all, and the original reporter just made a mistake.

Austrian?

[s_p_oneil]

Austrian? Maybe they should call this one the UEFInator.

Hanz: Aww, you're such a little girlie boot record.
Franz: We're going to "boot" you up.

Back in the 1980's

[ackthpt]

We saw all the tricks people employed to copy-protect games on the C64. Most of them were pretty weak. The most effective I recall were the methods which spread out their information gathering throughout the boot process. This prevented someone trying to break copy protection from easily identifying the part of code where the detection was executed. If Microsoft gathered information, throuhout the boot process it could easily assemble some sort of checksum to check the boot sector and identify if it wasn't genuine. Does it take more than 30 years to figure this sort of thing out?

Re:Back in the 1980's

[Anonymous Coward]

It does if you're Microsoft...

Re:Back in the 1980's

[Anonymous Coward]

The C64 loader known as Fastloader was an early usage of the LZH compression to bring more capacity to the tape system storage whilst reducing load times. Its true that certain security (null blocks in particular or "bad sectors") where used to validate security however these were often defeated as the primary loader needed (itself) to load into resident memory before going any further.
Per this discussion, i find it interesting again that the cat and mouse game is now afoot and it hardware level code signing is being used, its only a matter of time before some ingenious individual works or discovers the key.

Re:Back in the 1980's

[ackthpt]

The C64 loader known as Fastloader was an early usage of the LZH compression to bring more capacity to the tape system storage whilst reducing load times. Its true that certain security (null blocks in particular or "bad sectors") where used to validate security however these were often defeated as the primary loader needed (itself) to load into resident memory before going any further.
Per this discussion, i find it interesting again that the cat and mouse game is now afoot and it hardware level code signing is being used, its only a matter of time before some ingenious individual works or discovers the key.

Create a unique signature upon installation. Have validation gathering throughout boot-up and check. There's endless variations on this sort of scheme they could employ. Ultimately, if throughout the boot processes the OS identifies something is amiss it could lock the system down, affect repair, a number of things.

It's a cat and mouse game, alright, but one where the cat seems to be very slow thinking, clumsy to react and frequenly brained with an iron skillet.

Re:Back in the 1980's

[Bengie]

That's just "security" through obscurity. It's just a matter of time before someone finds the code that checks the checksum and modifies it.

The whole issue is if untrusted code can load before the OS, you've already lost.

Re:Back in the 1980's

[Anonymous Coward]

More probably the master key used to sign bootloaders is not anywhere in Windows code or UEFI ROM. MS provides a signed hash of a bootloader and a decryption key, while encryption key is stored somewhere in a vault at Redmond.

Re:Back in the 1980's

[Anonymous Coward]

Is this a suffering sucatash cat versus a south of the US mouse?

Re:Back in the 1980's

[znerk]

Create a unique signature upon installation. Have validation gathering throughout boot-up and check. There's endless variations on this sort of scheme they could employ. Ultimately, if throughout the boot processes the OS identifies something is amiss it could lock the system down, affect repair, a number of things.

... and what happens when the boot sector needs to be updated, perhaps due to some previously-undetected security hole? Now MS Office doesn't work, because the user allowed Windows to update the security.

Alternatively, MS Office does work, because the security patch also updated the security check - and now there's a method for finding the security checker and disabling it, which prompts another security patch...

This "arms race" style of rights management is getting a bit out of hand.

Re:Back in the 1980's

[znerk]

Yup, nothing quite like booting up already rooted - which is what I believe this exploit does.

If I understand it properly, it allows the system to boot in an insecure way, then pulls a hand-wavy Jedi mind trick, telling Windows 8's SecureBoot that everything is fine, nothing's unsecure, all is well... the trick being that SecureBoot believes it.

DMCA

[tsa]

If this Austrian guy is coming to the US to talk about this, will he not be arrested immediately because of the DMCA? And is the DMCA the reason that hacks like this seem to always come from Europe? Or am I paranoid?

Re:DMCA

[Stan92057]

Why does it matter where he talks about it? I'm pretty sure they can sue or whatever no matter what country hes in They are a world wide corporation with offices in just about ever country.

Re:DMCA

[YesIAmAScript]

You're paranoid. The DMCA allows reverse engineering for research.

Re:DMCA

[Anonymous Coward]

DMCA doesn't prohibit what he did. That doesn't mean anyone who doesn't like what he did, wouldn't attack him, but there's no legal basis for doing so.

Re:DMCA

[sexconker]

You're paranoid. The DMCA allows reverse engineering for research.

No it doesn't.
The reverse engineering clause only applies when there is no suitable official method of enabling compatibility, i.e., the company has gone belly up. There's also that fairly recent ruling that specifically says jailbreaking a phone is okay because moronic judges don't understand technology.

Re:DMCA

[MurukeshM]

I think he's coming to India. Unless there's a Mumbai in US too. At any rate, he may not come at all. Somebody's suing him in Austria over this, so he's got visa problems.

Seems a little early to announce it

[Zorque]

He probably should have waited until after W8 was released, now they have a chance to patch out all his hard work before anyone gets a chance to make use of it.

Re:Seems a little early to announce it

[znerk]

He probably should have waited until after W8 was released, now they have a chance to patch out all his hard work before anyone gets a chance to make use of it.

Microsoft is already aware of the contents of the entire paper, because he gave it to them.

MalCon in Munbai..pfffft!

[Roachie]

Im waiting for TradeSecretCon in Beijing

Misleading title, Secure Boot not defeated

[davidwr]

Without a UEFI computer that is configured to boot only signed boot-loaders, this is not a valid test of the Secure Boot technology.

Basically, this is a case of "of course it works that way in this scenario, it's supposed to."

Re:Misleading title, Secure Boot not defeated

[amliebsch]

Yup. FFS editors, your headline is straight up libel. FIX IT.

Re:Misleading title, Secure Boot not defeated

[BitZtream]

Maybe since CmdrTaco left they are all trying to get fired or get people to leave or something.

Re:Misleading title, Secure Boot not defeated

[znerk]

Without a UEFI computer that is configured to boot only signed boot-loaders, this is not a valid test of the Secure Boot technology.

... except that the Windows SecureBoot technology was tricked into thinking it was booting on a UEFI computer that was configured to boot only signed bootloaders. The headline is accurate.

Windows 8 Microsoft leveraging its dominance

[Crashmarik]

This is nice but unless its seamless and user friendly to the point of invisibility Microsoft gets what it wants, a computing environment that is that much more unfriendly to anything not windows. In this case they are going so far as making it unfriendly to old versions of windows as well as other operating systems. I guess they don't want to see future failures to adopt like they had with Vista and ME.

Re:Windows 8 Microsoft leveraging its dominance

[interval1066]

Kind of sounds like you're implying UEFI roms aren't going to work with unsigned os's, am I getting that right?

Re:Windows 8 Microsoft leveraging its dominance

[exomondo]

This is nice but unless its seamless and user friendly to the point of invisibility Microsoft gets what it wants, a computing environment that is that much more unfriendly to anything not windows.

How is it unfriendly to anything not Windows? They are just implementing the Secure Boot feature of UEFI, if you want to boot an OS that doesn't support it then turn Secure Boot off in the BIOS.

Re:Windows 8 Microsoft leveraging its dominance

[0123456]

How is it unfriendly to anything not Windows? They are just implementing the Secure Boot feature of UEFI, if you want to boot an OS that doesn't support it then turn Secure Boot off in the BIOS.

And when Microsoft refuses to 'Windows certify' motherboards that don't allow you to turn it off...?

Re:Windows 8 Microsoft leveraging its dominance

[0123456]

Duh, that was 'refuses to certify motherboards that do allow you to turn it off', obviously.

Re:Windows 8 Microsoft leveraging its dominance

[exomondo]

And when Microsoft refuses to 'Windows certify' motherboards that don't allow you to turn it off...?

Your conspiracy theory doesn't match with the certification guidelines that state that it has to support UEFI Secureboot, not make it a mandatory feature that cannot be turned off.

Re:Windows 8 Microsoft leveraging its dominance

[znerk]

And when Microsoft refuses to 'Windows certify' motherboards that don't allow you to turn it off...?

Your conspiracy theory doesn't match with the certification guidelines that state that it has to support UEFI Secureboot, not make it a mandatory feature that cannot be turned off.

... this time.

Re:Windows 8 Microsoft leveraging its dominance

[shutdown -p now]

The CIA black helicopters are not at your door yet to abduct you for horrifying experiments in Area 51.

... this time.

Re:Windows 8 Microsoft leveraging its dominance

[znerk]

Are you trying to say that Microsoft doesn't have a track record of doing anything and everything they can to restrain competing operating systems?

Or are you trying to say that "considering a scenario wherein a monopoly desktop operating system vendor who has been caught several times doing unorthodox and illegal things to keep their desktop operating system monopoly safe would do anything they could to prevent their competition from being able to compete" makes me paranoid?

Also, you shouldn't have said "yet" if you were planning to add "... this time". And you can complain about my grammar nazism all you want to, but doing the same thing in a program or shell script would yield unexpected results - that's why syntax is so important.

Re:Windows 8 Microsoft leveraging its dominance

[exomondo]

... this time.

Or ever in the past, when they quite clearly could have but didn't. Your conspiracy theory fails again.

Re:Windows 8 Microsoft leveraging its dominance

[znerk]

Go farther back in this thread, where I posted links showing some times when Microsoft has strong-armed PC manufacturers into not shipping competing operating systems, and/or threatened/coerced them into not shipping dual-boot systems.

As a matter of fact, point me at a single dual-boot (Windows and some non-Microsoft OS) PC produced by any major manufacturer... make that any manufacturer, period.

Re:Windows 8 Microsoft leveraging its dominance

[exomondo]

Go farther back in this thread, where I posted links showing some times when Microsoft has strong-armed PC manufacturers into not shipping competing operating systems, and/or threatened/coerced them into not shipping dual-boot systems.

Or maybe you could address the point right here, which is that while they could have locked down the BIOS to ONLY run Windows, which is effectively what your conspiracy theory is suggesting they will do with UEFI Secureboot, you would note that they have not ever done that even though they could have.

As a matter of fact, point me at a single dual-boot (Windows and some non-Microsoft OS) PC produced by any major manufacturer... make that any manufacturer, period.

How inept are you that you can't even use google, even if you can't remember 4 years ago when Dell started shipping PCs pre-loaded with Linux, but they didn't sell.

Re:Windows 8 Microsoft leveraging its dominance

[znerk]

How inept are your reading skills, that you can't even see the word dual-boot in my query?

Yes, PCs exist that ship with Linux on them - but none of those have Windows on them... which was part of my original point.

Part of the reason the Linux-equipped machines haven't sold well is that they have been crippled, hardware-wise, compared to the "equivalent" Windows system. "Half the ram" and "smaller processors" have been the norm, probably because Microsoft is afraid to compete on an even field - or perhaps it is due to over-estimating the efficiency of Linux in a desktop environment.

Re:Windows 8 Microsoft leveraging its dominance

[exomondo]

How inept are your reading skills, that you can't even see the word dual-boot in my query?

Who cares that they aren't sold as dual boot, why does that matter in any way whatsoever? Are you asserting that they aren't capable of dual booting?

Yes, PCs exist that ship with Linux on them - but none of those have Windows on them... which was part of my original point.

So? What's that got to do with UEFI Secureboot? It's not that they can't have Windows on them, they just aren't shipped with it, just as Windows machines aren't shipped dual booting Linux and Macs aren't shipped dual booting Linux or Windows with OSX.

Part of the reason the Linux-equipped machines haven't sold well is that they have been crippled, hardware-wise, compared to the "equivalent" Windows system. "Half the ram" and "smaller processors" have been the norm, probably because Microsoft is afraid to compete on an even field - or perhaps it is due to over-estimating the efficiency of Linux in a desktop environment.

Do you have evidence for that or are you just making that up?

Well MS better have the 7 start menu / gui enterpr

[Joe_Dragon]

Well MS better have the 7 start menu / gui enterprise use and not the cell phone based UI How many people have touch screen laptops / desktops any ways?

Maybe

[zoomshorts]

But my child is gay, what does that portend?

Re:Maybe

[hairyfeet]

That you should buy a Mac?

Sorry, but you know he walked right into that one, i just couldn't help it!

Re:Maybe

[znerk]

Does that mean the post should be moderated 'flamerbait'?

Sorry, I couldn't help it either.

commentors

[Anonymous Coward]

My god, so many, many idiots. I wonder who turns on the computer for them.

This is stupid

[Anonymous Coward]

To write to the MBR you need privileged/root access.

So, this thing that boots from MBR, gives you the root/privileged access you must have already had to write to the MBR? I give you the keys to my house, so you can change the locks and give me the key.

I don't want to be dismissive, but is this for real? It's not a hack.

Re:This is stupid

[harryjohnston]

If the exploit in question really had compromised secure boot, yes, it would be a hack - the whole point of secure boot is that it prevents the boot sector from being used as a way to elevate from administrator access to kernel-mode access. (And yes, in Windows 7 x64 the two are different, at least in theory.)

WRONG

[amliebsch]

This headline is incorrect, secure boot was not compromised. From the ARS story:

The exploit allegedly defeats the security features of Windows 8's new Boot Loader. However, Kleissner said in a message exchange with Ars Technica that the exploit did not currently target the Unified Extensible Firmware Interface (UEFI), but instead went after legacy BIOS. Kleissner said he has shared his research and paper and the paper he plans to present, "The Art of Bootkit Development," with Microsoft.

Secure boot does nothing if you have legacy BIOS.

Re:WRONG

[tepples]

Legacy BIOS does nothing if your PC's motherboard has died and all affordable replacements have secure boot that can't be turned off and which don't let the end user install new certificates.

Re:WRONG

[Missing.Matter]

and all affordable replacements have secure boot that can't be turned of

Pretty big assumption you're making there.

Re:WRONG

[Anonymous Coward]

Legacy BIOS does nothing if your PC's motherboard has died and all affordable replacements have secure boot that can't be turned off and which don't let the end user install new certificates.

You're also in a bad situation if your PC's motherboard has died and all motherboard manufacturers' factories have burned down and all existing stock is sold out...while we're on the topic of highly implausible situations that border on totally ridiculous. Seriously though why would any manufacturer do that? You think after all the heat MS has had with anti-trust regulators that for some reason they would somehow try and force motherboard manufacturers to not allow secureboot to be disabled?

Re:WRONG

[Tastecicles]

It's academic if your motherboard dies as a result of normal wear and tear; by that time you'd likely find nothing on the market that conforms to the pin form of your processor. So, it's new processor, new RAM, new board (hence new chipset), fresh install - because transplanting Windows between even just different chipsets is an oft-painful experience. Been there, worn the t-shirt.

Lesson you shouldn't have to learn the hard way, so don't say you weren't warned: BACK UP! BACK UP! BACK UP!

Re:WRONG

[znerk]

As I have stated over and over again in this thread, this hack doesn't have anything to do with UEFI, and it's not supposed to.

The target is Windows 8's SecureBoot technology. This hack allows one to boot from an unsecured boot chain, while telling SecureBoot "everything is ok, we're happilly booting from UEFI with a secure boot chain" - and SecureBoot believes it.

Car analogy: You push the button on the remote to lock the car doors, watch the lights flash and hear the alarm system "beep" to indicate that the doors are locked, and yet none of the locks are actually engaged.

Re:WRONG

[amliebsch]

The target is Windows 8's SecureBoot technology. This hack allows one to boot from an unsecured boot chain, while telling SecureBoot "everything is ok, we're happilly booting from UEFI with a secure boot chain" - and SecureBoot believes it.

Windows 8 *can* boot from an unsecured boot chain by design. Windows 8 does not require secure booting.

Re:WRONG

[znerk]

Windows 8 *can* boot from an unsecured boot chain by design. Windows 8 does not require secure booting.

Yes, it can boot from an unsecured boot chain, but does it think it's sitting on a secure boot chain? Or does it know that it's not on a secure boot chain, and shut back down (or decide not to boot) if it's configured to do so?

Like Wii

[tepples]

And "oui" is the French word for yes, not just the English word for urine.

Re:Like Wii

[Anonymous Coward]

And "une frappeur des mouton fou" is the French word for a citizen on the USA, not just a sexual practice illegal even in Corsica.

Re:Like Wii

[bmcage]

I can better this.
Ano [ http://sk.wikipedia.org/wiki/%C3%81no ] is yes in Slovak, not just Italian for http://it.wikipedia.org/wiki/Ano#Anatomia_umana

What about windows users?

[Anonymous Coward]

I don't know why you all want to screw windows users.

I, for one, want my windows computer to be safe against things like ophcrack + rainbow tables.

Re:Just another reason

[CheshireDragon]

wow, I am an avid Apple user and I am against this quote. How about another reason to fight for what we want and not give in to companies telling us what we want?

First I was mad at MS...

[Anonymous Coward]

At first I was being angry seeing all the mediocrity coming from that company.

Then it turned to laughter.

Nowadays I just want to cry. They're sad. So sad.

The day I have to jailbreak my PC...

[Tastecicles]

...to run software I WANT TO RUN ON IT is the day my Pentium Pro comes down out of the loft.

oh come off it

[Chirs]

EUFI is not a PC-compatible BIOS, but it's still a "basic input output system" used to load the "real" OS. Sure, the proper word is firmware, but really I wouldn't be surprised if most people still call it the BIOS.

Damnit!

[sgt scrub]

I gave it a month after release. I totally shouldn't have put $20 on it! Oh well. The odds were too good to pass up.

What is this for?

[__aavevi421]

I don't like any of the ways this can happen. It's MY computer, I built it and sometimes I like to install Windows. Sometimes I like to play with Linux. Sometimes I like to play with overclocking and keep rebooting until it actually stays usable for more than 5 minutes. The fact that there is an exploit is good. The fact that M$ is actually trying to screw us is bad, they will try harder every year. I have never actually had a computer virus.

Re:What is this for?

[exomondo]

There's always one in every secureboot story. So tell me, how are they trying to screw you?

This is disgraceful

[amliebsch]

Seriously, hello, editors? Is anybody home? This post is 100% false. The very subject of this story has tweeted:

No it's not attacking UEFI or secure boot, right now working with the legacy BIOS only (details will be in the paper)

Do the words "reckless disregard for the truth" have any meaning to you?

Re:This is disgraceful

[Anonymous Coward]

this is slashdot. anything that looks like MS has failed needs be mentioned.

seriosuly, not like slashdot has been a valid source of real computer info for years,. most people here have no idea what Enterprise computing is all about

Re:This is disgraceful

[znerk]

The information you're overlooking is that this is not an attack on UEFI, or the UEFI Secure Boot process.

The trick here is getting Windows to think it booted from a secure boot chain, and so not set off any alarms... even though it's already rooted by the time it thinks to check.

Re:This is disgraceful

[benjymouse]

The information *you* are overlooking is that Windows is not tricked into thinking it booted from anywhere. Secure boot is not enforced nor checked by Windows. It is *supported* through its boot loader.

Secure Boot is *supported* by the Windows boot loader by virtue of being digitally signed. No checks from Windows itself.

It is the UEFI firmware which checks the signature of the boot loader. This ensures the integrity of the boot load'er before control is passed to it. The Windows boot load'er in turn checks the integrity of the Windows it is about to boot. This ensures the integrity of Windows before control is passed to it.

This attack is NOT possible with UEFI secure boot. In fact, this is the reason *why* secure boot is necessary.

Wrong again

[geekoid]

The six additional exceptions are as follows:
1. Nonprofit library, archive and educational institution exception
(section 1201(d)). The prohibition on the act of circumvention of
access control measures is subject to an exception that permits
nonprofit libraries, archives and educational institutions to circumvent
solely for the purpose of making a good faith determination as to
whether they wish to obtain authorized access to the work.
2. Reverse engineering (section 1201(f)). This exception permits
circumvention, and the development of technological means for such
circumvention, by a person who has lawfully obtained a right to use a
copy of a computer program for the sole purpose of identifying and
analyzing elements of the program necessary to achieve interoperability
with other programs, to the extent that such acts are permitted under
copyright law.
3. Encryption research (section 1201(g)). An exception for encryption
research permits circumvention of access control measures, and theThe Digital Millennium Copyright Act of 1998
Copyright Office Summary December 1998 Page 6
development of the technological means to do so, in order to identify
flaws and vulnerabilities of encryption technologies.
4. Protection of minors (section 1201(h)). This exception allows a court
applying the prohibition to a component or part to consider the
necessity for its incorporation in technology that prevents access of
minors to material on the Internet.
5. Personal privacy (section 1201(i)). This exception permits circumvention when the technological measure, or the work it protects, is capable
of collecting or disseminating personally identifying information about
the online activities of a natural person.
6. Security testing (section 1201(j)). This exception permits circumvention of access control measures, and the development of technological
means for such circumvention, for the purpose of testing the security
of a computer, computer system or computer network, with the
authorization of its owner or operator.

http://www.copyright.gov/legislation/dmca.pdf

`(f) REVERSE ENGINEERING- (1) Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.
`(2) Notwithstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title.
`(3) The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.
`(4) For purposes of this subsection, the term `interoperability' means the ability of computer programs

Re:Wrong again

[tsa]

So according to your post what he did is illegal in the US.

Re:Wrong again

[sexconker]

That's only about "access control measures", and not about what everyone ever, uses to protect their access control measures - encrypted and copyrighted keys.
You can "reverse engineer" all you want so long as you don't try to find, or generate on your own, a copy of the key. Any such attempts are, of course, futile and pointless and amount to basically nothing. Under the DMCA, you can't reverse engineer anything that uses an encrypted or copyrighted key. The only exception to this has been when courts have granted people permission to do so for compatibility in cases where the original vendor is kaput, and when a stupid judge thought an iPhone was somehow a unique class of device.

Remember the whole PS3 thing? Absolutely zero progress despite Geohot posting bullshit fakes and useless "hurr durr I electrocuted my PS3 and about 4% of the time it crashes in a different way but still yields no useful information". Then, out of thin air, a magic little USB device appeared that let you boot your PS3 into recovery mode. That thin air, of course, was someone stealing it from Sony and passing it on to some hackers who created clones of it. Sony went after anyone and anyone who tried to sell these keys wherever they could under the DMCA or similar laws (they had a few big hits in Australia, for example). Hackers then proceeded to use these devices to reverse engineer the PS3 (get at keys). And DERP! Every PS3's key was the same! So people did not need the dongles anymore. Sony then went into full litigation mode against anyone distributing those keys.

If the DMCA allowed people to reverse engineer the PS3 as you saw fit, they wouldn't have all been advised by their lawyers to STFU and settle.

Product differentiation

[tepples]

Seriously though why would any manufacturer do that?

Product differentiation. It's not that Microsoft would require motherboard manufacturers to disable secure boot. It's just that motherboard manufacturers would voluntarily hardcode Windows-only secure boot on their home-user-priced products and treat the ability to disable secure boot or to install one's own certificates as a niche feature suitable for a value-added upsell. Compare to the price difference between a retail game console and a debug console used by licensed developers.

Einstein, please answer this then

[benjymouse]

Windows 8 does not *require* secure boot. Windows 8 does not *require* UEFI. The Windows 8 boot loader is *signed* so that it will support a system with secure boot.

How exactly was this about piracy when Windows 8 can be installed on hardware without UEFI, when Windows 8 can be booted without secure boot, when Windows 8 can be booted through an alternate boot loader?

Re:Einstein, please answer this then

[znerk]

Perhaps windows 8 doesn't require it, but windows 9 might have... if this is so ineffective that it has been broken before the first os that even supports it is released, maybe it'll get treated like the ridiculous garbage it is, and round-filed before it becomes an industry standard, and thus a potential security hole.

Re:Einstein, please answer this then

[Dr_Barnowl]

Windows 8 does not require secure boot - but getting a "designed for Windows 8" sticker requires that the feature is present, and switched on, in your system as shipped.

The chilling effect that this will have on alternate operating system use (because it now requires more steps than just inserting a LiveCD / LiveUSB) is quite aside from the security implications of defeating the Windows 8 or UEFI bootloader though.

Re:Einstein, please answer this then

[hairyfeet]

Don't worry friend, because talking to my customers and showing them the win 8 screencaps all I have gotten is HATRED, they HATE the "cell phone" UI as they call it, they HATE the irritating FB way of having things, they HATE the entire design and want NOTHING to do with it!

I personally think the engineers have gotten sick of Ballmer's bullshit and are letting him have every stupid thing his big fat clueless heart desires. you heard the expression "give them enough rope"? I think that is EXACTLY what we have here. he ran off Chen, hell even ran off Ozzie whom I thought would die as a Microsoftie, and from the rumors on the net Win 7 was only saved by letting the office team come in and fix Ballmer's mess. finally you add in the fact Win 7 is supported until 2020 (letting people easily skip this horror show) and I smell a setup.

No friend I think this is the true blues inside MSFT getting fed up with a decade of ballmer and are letting every single stupid ass idea he has go into the OS. Instead of anyone pointing out how dumbshit it is to fuck up the brand by putting win 8 on ARM and calling it win 8, which of course is sure to flood retailers with returned tablets when folks get these "Windows" tablets home and find their X86 software won't run, they are all saying "Sure Steve, that is a WONDERFUL idea, you're a fucking genius!" and kicking back and waiting for the fail so the shareholders can finally force the sweaty monkey to "pursue other interests" and they can go back to making a solid desktop again.

Re:Einstein, please answer this then

[Anonymous Coward]

I love the smell of butthurt on a friday afternoon.

MOD PARENT UP

[Anonymous Coward]

MOD PARENT UP - yes, even though he's an AC.

RightSaidFred99 apparently hasn't got his thinking cap on, and was vehement in defense of an unknown. The AC may have used a lot of profanity to get his point across, but that is likely a result of RightSaidFred99's use of profanity, and does not invalidate the AC's point.

Posting as AC because any karma resulting from my defense of an AC who had the audacity to be right is likely to be negative.

Un-patchable

[DrYak]

This kind of flaw kind be patched.
The exploit is caused by a design flaw:

For the whole SecureBoot thing to work, every single step on the chain has to be secure.
i.e.: On power up, the computer starts a known and secure UEFI firmware. This firmware load a bootloader from the system GPT partition, and checks that it's correctly signed. Then in turn, this bootloader loads the relevant OS parts and check them further, etc.
For each step to be secure, the previous needs to have been secured too.

If any previous step is compromised, you can't trust any further step.
i.e.: The guy boots in plain BIOS-compatible mode. This mode loads and executes without any question the guy's MBR. This MBR installs a rootkit before actually booting. The root-kit pretends that a SecureBoot process did happen, and te OS does believe it.

From the point of view of the OS there's no way to tell if the "a Secure Boot process did successfully happen" is coming from a real secure boot process, and the checksum it's getting is a legitimate one, which is successfully signed with legitimate keys that the OS possess, or if the message one is a bogus one, produced by a root-kit mascarading as a secure bootloader, and that the message is successfully recognised, because it is checked against bogus keys which where injected into the OS by the root-kit (or the whole signing-check process being NOP-ed out by the root-kit). You can add more layer as you want to check the checks (checksumming the checksummer it-self, contacting a remote server, whatever else), these will be as easily defeated by the same trick (the root-kit compromising the checksum-checker, diverting the check to a compromised or a local server, etc.).

The other /. have a nice metaphor of playing a "Jedi Mind Trick" into making the OS believe that everything is Okay.

I find another image also helpful: You wake up in your hotel room, how to you know that your business suitcase wasn't tampered with, if absolutely anything could have happened while you were alseep?

Re:Un-patchable

[amliebsch]

From the point of view of the OS there's no way to tell if the "a Secure Boot process did successfully happen" is coming from a real secure boot process, and the checksum it's getting is a legitimate one, which is successfully signed with legitimate keys that the OS possess, or if the message one is a bogus one, produced by a root-kit mascarading as a secure bootloader, and that the message is successfully recognised, because it is checked against bogus keys which where injected into the OS by the root-kit (or the whole signing-check process being NOP-ed out by the root-kit).

But it doesn't really matter. Having booted securely does not enable or disable any particular functionality in Windows. The ONLY point of it is to prevent rootkits from replacing the boot sector and thereby compromising all the other system security. Once the signed boot sector is loaded, its job is done.

And they are probably happy about it

[benjymouse]

He probably should have waited until after W8 was released, now they have a chance to patch out all his hard work before anyone gets a chance to make use of it.

Microsoft is already aware of the contents of the entire paper, because he gave it to them.

My guess is that Microsoft is actually quite pleased. It absolutely reinforces their argument *for* UEFI Secure Boot - as this very attack vector is exactly what is being closed by UEFI Secure Boot.

That's still not a valid test

[davidwr]

"He who loads first wins."

Anything that loads before you do can pretend to be something that it is not unless, of course, something that loads before it does (or hardware) stops it.

Anything that loads before you can modify you before allowing you to run unless something that loads before it does (or hardware) stops it.

In other words, if you aren't the hardware, you are at the mercy of the hardware. If you aren't the first to load, you are at the mercy of anything that loads before you do.

Re:That's still not a valid test

[znerk]

How is it not a valid test? If the concept is to provide a secure boot chain, and it can be fooled into thinking it has a secure boot chain when it does not, then the concept has been proven to be flawed. This entire line of reasoning is flawed, and "Secure Boot" is broken before it is even a product.

Re:That's still not a valid test

[davidwr]

The Windows Secure Boot assumes a specific model of a secure boot chain for the code that loads prior to the Windows boot-loader.

Booting under classic BIOS violates this assumption.

I think we are in agreement on one thing:

"can be fooled into thinking it has a secure boot chain when it does not, then the concept has been proven to be flawed."

But this is not news as it applies to running Windows in a boot environment like classic BIOS that doesn't claim to be a secure boot chain. Not only is it not news, it's more like "duh, what did you expect?"

Let's look at it another way:

With a sufficiently fast computer - fast so I can avoid timing-based detection - I can create an emulator of a computer that boots in an UEFI environment. Windows sees it as EUFI and proceeds to boot "securely." But since it's an emulator the host system literally "owns" the whole virtual machine and can do whatever it wants to with it. Windows 8 doesn't know it's running in a virtual environment, it doesn't know it's being lied to, it doesn't know the virtual environment is capable of changing the very code that is Windows between each emulated instruction cycle. Windows 8 doesn't know it's in The Matrix.

In other words, unless you can trust what loads before you to play by the rules and give you a secure boot chain, then it's game over. And you can't take its word for it that it's playing by the rules.

Re:That's still not a valid test

[znerk]

I thought the whole point of SecureBoot was to ensure a secure boot chain?

Also, what exactly are we arguing about, if we're in agreement about my point?

Re:That's still not a valid test

[davidwr]

Also, what exactly are we arguing about, if we're in agreement about my point?

We are in basic agreement, but we disagree on what a "valid test of Windows 8 secure boot" means.

I contend that a valid test of Windows 8 secure boot can only be done if the hardware, firmware, and MBR prerequisites for secure boot are in place beforehand. Otherwise, you aren't really testing Windows 8 secure boot you are testing earlier aspects of the secure boot process which the Windows 8 developer team shouldn't get the blame for.

To put it another way:

The title "Windows 8 Secure Boot Defeated" is incorrect as it applies to the linked story.

A better title would be "Windows 8 Secure Boot doesn't work on computers that do not meet the prerequisites that Windows 8 Secure Boot requires."

Re:That's still not a valid test

[znerk]

If it claims to be secure, but can be defeated simply by toggling an option in the pre-POST OS' system setup software (and infecting the boot sector), then it's not just insecure, it's ridiculously insecure.

Your argument about an unfair test is a bit like claiming that a specific vehicle will never lose traction, and then complaining about someone violating the test conditions of "a particular brand and model of tire are used, and one doesn't operate the vehicle unless the weather conditions are 'temperatures between 65 and 75 degrees, no clouds, a humidity between 25 and 30 percent, and no precipitation'".

"Huh, that's funny, I got it to slide off the road and into a ditch..."
"It's not fair! You drove it in the rain!

This technology is going to have to function in the real world, not just a laboratory setting.

Re:That's still not a valid test

[harryjohnston]

The primary purpose of secure boot is to prevent malware from installing rootkits. So unless you can change the UEFI configuration from software, it doesn't matter that the OS can't tell for sure whether it was securely booted or not.

However, if you do also want to defend against an attacker who has physical access to the machine, it is my understanding that secure boot can be combined with encryption in such a way that the encryption key is only provided if secure boot was successful. I think that addresses your concern?

Re:That's still not a valid test

[harryjohnston]

(Except that with physical access you can attack the hardware directly, e.g., rewriting the kernel code by modifying RAM content directly. But that requires somewhat more sophistication than installing a bootkit.)

So what is a valid test you ask?

[davidwr]

A valid test is a test of a complete machine, already "locked down" to some degree before you get it. In this case, this means computer plus BIOS plus operating system loader plus operating system up through the first opportunity for the user to interact with the system.

If you as a human being can "take control" before you are supposed to, then that particular combination of hardware, BIOS, OS loader, and OS fails the test.

App Stores & DRMs

[DrYak]

But it doesn't really matter. Having booted securely does not enable or disable any particular functionality in Windows.

For now it's only a small check box "Has been booted securely". For. Now.

Applications stores, DRM system in software, digital media copy prevention, and much more other mechanisms are all going to slowly start relying on a securely booted system.

Today's demonstration shows that relying on trusted code runing through a secure boot procedure is a flawed idea. It will be broken eventually, just like DRM is.

jailbreaking is okay is not a "ruling"

[YesIAmAScript]

The Library of Congress is allowed to nominate specific exemptions to the DMCA due to clauses in the DMCA. Jailbreaking was one of them. It was not a ruling, the Library of Congress isn't a court.