Slashdot Mirror
Researchers Demo Exploits Bypassing UEFI Secure Boot
itwbennett writes "Researchers demonstrated at Black Hat this week two attacks that bypassed Secure Boot in order to install a UEFI bootkit — boot rootkit — on affected computers. The first exploit works because certain vendors do not properly protect their firmware, allowing an attacker to modify the code responsible for enforcing Secure Boot, said researcher Yuriy Bulygin, who works at McAfee. The second exploit demonstrated by the researchers can run in user mode, which means that an attacker would only need to gain code execution rights on the system by exploiting a vulnerability in a regular application like Java, Adobe Flash, Microsoft Office or others. In both cases, the exploits are possible not because of vulnerabilities in Secure Boot itself, but because of UEFI implementation errors made by platform vendors."
Of course, a hardware security system that is too complex to verify seems like a fatal flaw.
Hence why UEFI should be dismissed. If it's useless, just don't implement it, it's cheaper...
I gave up with the idea of an useful sig...
UEFI was never intended to improve security. Along with Microsoft's extensions it was designed as a lock-in tool. Too bad we had to wait until it pops up everywhere just to realize it.
Film at 11.
I do not fail; I succeed at finding out what does not work.
"Of course, a hardware security system that is too complex to verify seems like a fatal flaw."
Why is that? We cannot verify that CPUs do not have "secret knock" codes. Is that a "fatal flaw"? All it really means is that you can't be sure that your CPU isn't performing any malicious activity. The best you can do is trust that it isn't. I suppose you could spend all your time looking for such evidence, but you still wouldn't be able to prove a CPU isn't performing malicious activity in exactly the same way you cannot prove a non-trivial program is correct simply by testing it on enough inputs.
What a fool believes, he sees, no wise man has the power to reason away.
Does this mean I can't install Linux or Windows 7 on a UEFI Secure Boot machine? (Newbie here)
"Of course, a hardware security system that is too complex to verify seems like a fatal flaw."
The reality is that the effort is too much bother for the cost-cutting PHB, it's not that it can't be done, it's that they won't bother to do it.
It's no different than a vault door that somebody won't bother to lock and keep the key to enter secure. There is no implementation, hardware or software, that is so secure, it can protect you from yourself. OpenBSD, SeLinux, TrueCrypt, they can't keep you from putting your root password on a Post-It note stuck to the side of your monitor.
Similarly, nothing can stop a manufacturer from completely fucking up their hardware security, as any number of phone users have learned.
Just not how it is implemented with MS as the gatekeeper with the private key.
I hate the BIOS. It is 30 years old, archaic, has weird instructions such as do not use more than 1 meg of ram, and many hacks and patches to get around the original 30 year old hacks like the 1 meg limit, etc. ACPI for a fucking decade never quite worked! Linux got blamed because companies like Dell did things a little differently with their ACPI so when the computer went to sleep sound would not work when it came up etc.
Remember the SOYO boards 10 years ago which you had to disable power management before they even booted? What about the 10 year old Dell machines which put everything in IRQ 11? Want to upgrade your video card? Nope conflicts and BSOD. OF course slashdotters blamed XP, but investigation showed the IRQ conflicts were caused by crappy ACPI.
The list goes on and on.
EFI was supposed to fix this and use firmware like everything else modern. I like the secure boot idea and wish you could change the keys so you can sign any OS with a C.A.? Just put in a jumper or a master password. I like the idea of TPM for encryption as well. UEFI was supposed to replace the archaic ancient BIOS. Not supplement it and have MS be the gatekeeper.
To me perhaps a new UEFI where these issues are addressed and intel could perhaps provide a Windows 7 driver too as many of us and corps who need Windows God forbid wont touch Windows 8 or anything else and would like these features.
Linux as a result would be less buggy if everyone played by the same standards.
http://saveie6.com/
so an windows 7 UEFI boot loader can come out
Clearly what we need here is another, lower layer of bootkit protection to protect UEFI secure boot.
(100 years later....)
"Oh no! All 6000 layers of bootkit protection have been breached!"
"Those fools! If only they'd given it 6001 layers! When will they learn!?"
"When information is power, privacy is freedom" - Jah-Wren Ryel
Do tell who made made this piece of shit.
Increases in complexity are usually increases in security vulnerabilities.
Also, boot times and installation are now longer and more complex...and just like the NSA, we are still no better in our security.
What a horrible joke.
Good luck finding new "machines which cannot run the Secure Boot feature" at an affordable price once virtually every name-brand home PC not made by Apple ships with Secure Boot turned on in Windows-only mode. The last time GNU/Linux had a reasonable chance to ship on home PCs was netbooks, and Microsoft quickly killed that by offering deeply discounted Windows XP licenses for ULCPCs.
A method of disabling Secure Boot is required by the spec and by Microsoft.
In Windows 8 (x86 and x86-64), it is required. In Windows RT, it is forbidden. And other comments to this topic speculate that Microsoft is likely to license Windows 10 like Windows RT in this respect.
If they'd included a classic shell
Microsoft did one better by providing hooks for third party developers to create classic shells for Windows 8. I know of at least two classic shells, one of which is actually called Classic Shell.
In my blog, I describe my use of BootIt Bare Metal to rapidly test installs of "semi-embedded" software I write that involve wrapping third-party installs of drivers as sub-installs. This will work only as long as BIOS's and Microsoft continue to support "legacy mode". I'm just hoping that the scientific & embedded world finishes moving to Linux before "legacy mode" disappears.
"Of course, a hardware security system that is too complex to verify seems like a fatal flaw."
Then again, who is telling us that they actually bothered to verify anything? Where exactly does this assumption come from that the system is too complex to implement?
You can write buggy and flawed software in any language, framework and system - regardless of its ease of use.
Amen
Learning HOW to think is more important than learning WHAT to think.
Sorry, but if it's not directly built in as a user accessable option, then who cares if the hooks are there.
There is a user-accessible option to open Internet Explorer, type windows 8 classic shell into the Bing search box (which produces this SERP), and click the first result. Or is your complaint that Microsoft provides no means to discover that such a classic shell exists in the first place? If that's true, then the same is true of obscure registry settings that do exist in Windows, and it's true of the existence of web browsers other than IE.
Speaking of IE, Microsoft got in trouble with competition law for including things with Windows. I'm guessing this is why Microsoft declined to ship MSE bundled with Windows XP, Windows Vista, and Windows 7 so as not to be perceived as using its Windows market power to gain antivirus market power.
[People who bought a GNU/Linux netbook tended to be unsatisfied] because they didn't know how to use Linux. They'd buy the machine, get it home, unbox it, boot up, then suddenly ask 'What the hell is this crap?' and 'Why can't I install my software?'.
Unfamiliarity with the GUI didn't stop people from taking to the iPad. The reason has to be more subtle.
Yep. TPM really is a better design than what's in UEFI. The attack surface against UEFI is quite big.
I actually have a third exploit against part of the whole Secure Boot process, this time a Microsoft bug in Windows itself that lets me load unsigned kernel code at boot time with Secure Boot enabled.
This flaw works on all architectures, so I'm saving it for now. I found it trying to find a new jailbreak for Windows RT 8.1.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
OF course slashdotters blamed XP, but investigation showed the IRQ conflicts were caused by crappy ACPI.
You'll no doubt be pleased to hear that UEFI still requires ACPI in all its crappy glory.
You get to pick 2 ... on a good day.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I don't get any of it. Why does UEFI even exist?
I've never understood why people haven't implemented something lean and clean like OpenBoot/OpenFrimware on x86. Yeah, I know there are working implementations out there, but it's not a standardized thing so it doesn't really matter. So instead of having a nice firmware environment that is designed to boot the friggin' OS and get the hell out of the way, we've got this fucking monster of a firmware called UEFI that is essentially a pile of garbage with so much extraneous crap bolted on that it is frankly quite amazing.
Why? Is this the best that we can do these days? I mean, seriously, why the hell do people put up with this shit? Why the hell hasn't Microsoft been sued for antitrust again or something by requiring this rubbish on all the new computer?
What boggles my mind is that it seems totally unnecessary. We should have a totally barebones firmware designed for booting things off media, and then an optional way to include stable storage on the motherboard for all the crap people might not want by default. Like an SD card, or hell- even a USB port. Lots of servers have internal USB ports that you can jam a key into to boot into a hypervisor or some other embedded OS. Why can't all the stupid Microsoft-centric bits reside on a USB key sticking out of the motherboard? Then if I don't want them, I don't need their "boot key" installed on the internal USB port.
So, using coreboot should help, by preventing security by obscurity. It have a lot of benefits: open source, small size, fast boot (while UEFI just a whole operating system, though without multithreading) and so on... Also it should help prevent some security problems of proprietary UEFI/BIOSes.
as long as it makes it more difficult to run or install linux or *bsd or other alternative operating systems, then it has done its job.
i always thought that Restricted Boot was created to advance the interests of Microsoft and the RIAA....but it wouldn't surprise me if the NSA was behind it too.
I guarantee you very shortly after UEFI was even thought about the NSA would be at their door with a mandated back door, and covered by NSL Letters! So UEFI is protection from insecure boot, except if the Gov. wants in.