Windows 8 Secure Boot Defeated

jhigh writes "An Austrian security researcher is scheduled to release the first 'bootkit' for Windows 8 at the upcoming MalCon in Mumbai. This exploit loads in the MBR and stays memory resident until Windows loads, resulting in root access to the system. This allegedly defeats the new secure boot features in Windows 8's bootloader."

Comments

Could open your system up to malware like Linux

[elrous0]

But if the Windows bootloader integrity is compromised, we could all end up infected with Ubuntu, Debian, FreeBSD--god only knows what!

Won't someone PLEASE think of the children?!?!?

Re:Could open your system up to malware like Linux

[Anonymous Coward]

That's what Edubuntu's for.

Re:Could open your system up to malware like Linux

[liquidweaver]

Someone has thought of the kids!! http://maketecheasier.com/doudoulinux-a-fun-linux-distro-for-kids/2010/11/26

Re:Could open your system up to malware like Linux

[c 0xFF]

Actually, it refers to a teddy bear. Kinda cute, with unfortunate implications to the American ear.

Re:Could open your system up to malware like Linux

[Anonymous Coward]

Doudou is the French for comforter; a child favorite blanket, teddy bear or a scarf.

Re:Could open your system up to malware like Linux

[hairyfeet]

Actually it doesn't have a damned thing to do with linux and everything to do with pirates. if you look on any BT site you'll find "Windows 7 all versions pre activated" which passes WGA and has for nearly two years. it does this by running a bootloader that fakes an OEM signature so MSFT would have to kill the keys for the major OEMs thus causing more than a little shitstorm from all those that bought win 7 PCs and suddenly were told they are pirates.

So despite all the bullshit from MSFT that it was about security, and despite all the FOSSies screaming "Its a plot to kill Linux!" in actuality it was just MSFT playing whack a mole with the pirates and yet again losing.

. The sad part was they HAD the cure for piracy in the west, I saw with my own two eyes as many pirates which had NEVER paid for Windows suddenly were running legit. i'm of course talking about the Win 7 HP $50 upgrade. When they killed that suddenly the local CL was filled with $100 PCs with $300 Windows installs. Just more proof Ballmer is as shitty a CEO as the Pepsi guy was for Apple.

Secure boot is UEFI

[Anonymous Coward]

Secure Boot is a UEFI feature, not Windows one. The article makes no reference to UEFI whatsoever - and it offers no explanation either for what mechanic was actually defeated. I do doubt the integrity of the article ARS is using.

Re:Secure boot is UEFI

[Anonymous Coward]

>>I do doubt the integrity of the article ARS is using.

Are you suggesting that ARS was compromised?

Re:Secure boot is UEFI

[makomk]

Secure Boot is a Windows feature building on a UEFI feature. If I'm understanding it correctly, every stage in the chain needs to be secure in order for the boot to actually be secure - a security flaw in either the UEFI firmware or the Windows code could render it ineffective.

Re:Secure boot is UEFI

[Anomalyst]

a security flaw in either the UEFI firmware or the Windows code could render it ineffective.

Let's get real, what are the odds of a flaw in Windows code?

Re:Secure boot is UEFI

[cvtan]

No. They just got it ARS backwards.

Re:Secure boot is UEFI

[afidel]

You are correct, this is just an update of his previous exploit against other Windows versions, it only works with legacy BIOS, not against EUFI with secure boot. The story over at ARS has been updated.

Re:Secure boot is UEFI

[cbhacking]

The funny thing is, this kind of thing is exactly the reason *for* Secure Boot (the non-conspiracy one, not the one that Slashdot is typically talking about). If you're using UEFI and you can verify a chain of trust, then you don't have boot sector malware. The fact that boot sector malware is possible on Win8 if you're NOT USING UEFI (because you're using an MBR) is not only obvious, it's the problem that Secure Boot is supposed to prevent.

I wonder, among the peoople who tagged this "irony", how many actually ahve the right of it. The only irony in the situation is that Slashdot is so rabidly opposed to the idea that a headline which is factually incorrect (blatantly obviously so) is posted because it is compatible with the popular bias, despite having no basis in the technology that we nerds supposedly understand.

That all said, there are certainly valid concerns about Secure Boot. It's entirely possible that they outweigh the value of making malware like this impossible. You should know what you're up against when you argue your case, though.

Horray!

[Tyrannosaur]

Finally a jailbreak for the desktop! I was tired of using locked-down hardware! I will now run a jailbroken desktop exclusively.

Windows or UEFI?

[dreemernj]

Is this an exploit of Windows or of UEFI in general?

UEFI doesn't have MBR

[Manip]

Uhh UEFI literally has no MBR, it doesn't exist. So please explain to me how this exploit functions when the MBR doesn't exist? I think he is booting his drives in the wrong mode, which is to say legacy MBR mode instead of ADAPI/UEFI mode.

From the "What took so long?" Department....

[apcullen]

This would have been solved sooner if Modern Warfare 3 hadn't been released last week...

Not broken

[BitZtream]

I thought the point to the UEFI secure boot thing was that the UEFI wouldn't boot without the MBR and remainder of the boot blocks being properly digitally signed.

Unless someone broke the digital signature system or found a flaw in the implementation, this sounds more like working as intended.

The article also seems to think that the boot loader is supposed to be encrypted for some silly reason.

Seems pretty clear that the article doesn't understand how it works, so its hard to imagine theres much truth in it. If you tell the UEFI to ignore digital signatures on the boot loader then yes, it has been compromised ... cause you turned it off. Intentionally turning it off doesn't count as breaking it guys, sorry.

If there was a claim of a flaw in the UEFI Secure boot implementation or design, then I'd listen, but the fact that its being called a windows exploit when it occurs before Windows has been started kinda sets off signal flares, ya know?

Back in the 1980's

[ackthpt]

We saw all the tricks people employed to copy-protect games on the C64. Most of them were pretty weak. The most effective I recall were the methods which spread out their information gathering throughout the boot process. This prevented someone trying to break copy protection from easily identifying the part of code where the detection was executed. If Microsoft gathered information, throuhout the boot process it could easily assemble some sort of checksum to check the boot sector and identify if it wasn't genuine. Does it take more than 30 years to figure this sort of thing out?

Misleading title, Secure Boot not defeated

[davidwr]

Without a UEFI computer that is configured to boot only signed boot-loaders, this is not a valid test of the Secure Boot technology.

Basically, this is a case of "of course it works that way in this scenario, it's supposed to."

This is disgraceful

[amliebsch]

Seriously, hello, editors? Is anybody home? This post is 100% false. The very subject of this story has tweeted:

No it's not attacking UEFI or secure boot, right now working with the legacy BIOS only (details will be in the paper)

Do the words "reckless disregard for the truth" have any meaning to you?

Re:Maybe

[hairyfeet]

That you should buy a Mac?

Sorry, but you know he walked right into that one, i just couldn't help it!