Responsible stewardship of the UEFI Secure Boot ecosystem

https://mjg59.dreamwidth.org/60248.html

by Harvesterify • 4 years ago

383 276 4 years ago

mjg59.dreamwidth.org

Previous discussion: https://news.ycombinator.com/item?id=32023868

chr15p• 4 years ago

that was a discussion of a previous blog post by the same author (Mathew Garrett). Its on the same subject but this one is much longer and goes into much more detail.

rob_c2• 4 years ago

It doesn’t add much other than a lack of open public docs of a new feature that’s not been widely adopted yet. I’m not panicking.

Arnavion13• 4 years ago

Non-Cloudflare-captcha link: https://web.archive.org/web/20220712083007/https://mjg59.dre...

("Please stand by, while we are checking your browser... Please turn JavaScript on and reload the page." No thanks.)

skywal_l2• 4 years ago

TLDR: So essentially, if the Lenovo laptop does not allow to boot on linux (or anything that is not Microsoft sanctioned) by default without a modification of the boot options, this is not because of Lenovo but because, in order to be certified by Microsoft, Lenovo has to comply with a set of rules that are not public and as such, impossible to follow for non-Microsoft entities.

Edit: So, as Arnavion commented right below, my TLDR is incorrect inasmuch the fact that Microsoft requirements are not public only prevent us to understand why this change was made.

trasz• 4 years ago

This is a gross misrepresentation of what this article is about.

skywal_l2• 4 years ago

Hanlon's razor. It might just be a gross misinterpretation. Please enlighten me.

jsiepkes7• 4 years ago

As far as I can tell the summary is exactly what the article is about.

Arnavion13• 4 years ago

a set of rules that are not public and as such, impossible to follow for non-Microsoft entities.

This is not correct, in that there's nothing for "non-Microsoft entities" to do in this situation regardless of whether the rules are public or not. The only CA that non-Microsoft bootloaders can be signed by is the UEFI CA, and that is not going to change. At least not in the sense that non-MS bootloaders could ask to be signed by the CA that signs Windows (the one that's still trusted by default), because it has obviously always been intentional that Windows was signed by a different CA than the common rabble.

The only piece of information we're missing, and which having the docs become public would reveal, is why this change needed to be made, so that we can then either sulk about it or try to get it reverted or resolved in some way.

Edit: Note that SB has had a revocation list concept built-in since the beginning, and this list is designed to be serviceable by regular OS updates (the OS can just modify the EFI vars, no manual firmware flashing required like it was with BIOS). So it was not a problem even if some bootloaders got signed that shouldn't have. That's why it's weird that such a drastic approach is being taken.

Avamander21• 4 years ago

The only piece of information we're missing, and which having the docs become public would reveal

It has been documented for a while really:

https://docs.microsoft.com/en-us/windows/security/identity-p...

aosmith3• 4 years ago

I would feel better if this was spun off into a b-corp with a perpetual grant.

yellowapple• 4 years ago

I agree, and I don't know why anyone would disagree sufficiently strongly to downvote your comment for suggesting that. Microsoft being directly in control over what can boot by default on PCs was and still is a blatant conflict of interest, and transitioning that decisionmaking to an independent body with input/control from more than just Microsoft would alleviate that considerably.

aosmith3• 4 years ago

Yup, we did it with SSL a long time ago...

usr11062• 4 years ago

https://en.m.wikipedia.org/wiki/Benefit_corporation for those not familiar with US terminology.

justinclift• 4 years ago

Possibly better not under US control? Though I kind of reckon it'd have to be some inter-governmental thing rather than "pick a better gov". ;)

aosmith3• 4 years ago

SSL isn't under government control, the same thing could be applied for secure boot.

Arnavion13• 4 years ago

As shitty as it is, it's nice of Lenovo to at least make it easy to enable the second CA. I wonder if all OEMs will be as "nice", or if any will require you to boot into Windows just to edit the EFI variables to add the second CA.

Edit: Also, I've read a few horror stories of systems no longer displaying anything after the UEFI CA was removed from the trusted CAs, because there was no iGPU and the discrete GPU required an OpROM. No display meant no way to boot into the UEFI firmware to revert that change or even disable SB. How is that not a problem now?

jsiepkes7• 4 years ago

There used to be a requirement by MS mandating secure boot to be disable-able. Though I think they scrapped that requirement later on. No idea if third party CA enabling also has such a requirement.

usr11062• 4 years ago

Disabling secure boot is one thing you should be able to do with hardware you own. Of course that's not a good idea if you want to run a non-Windows OS in a secure manner. Installing your own CA cert should also be possible. That's what we do at work with current UEFI implementations.

cesarb4• 4 years ago

There used to be a requirement by MS mandating secure boot to be disable-able.

Not always, in some situations there was a requirement by MS mandating secure boot NOT to be disable-able: https://softwarefreedom.org/blog/2012/jan/12/microsoft-confi... "Disabling Secure [Boot] MUST NOT be possible on ARM systems."

AshamedCaptain30• 4 years ago

On the early Surface Pros at least, you had to boot into Windows and run a PowerShell script to enable the MS UEFI CA certificate. These days it looks like they made it a option on the system firmware.

Arnavion13• 4 years ago

Yeesh. Yet another thing to check for before buying a mobo / laptop.

jillesvangurp3• 4 years ago

Sounds like the same anti competitive behavior that MS was punished for two decades ago. Making it a requirement to only boot software approved by them excludes a whole range of competitors from using the same hardware. Making that a condition for OEMs to even get a license is the problem here.

Lenovo is otherwise known for supporting Linux on their laptops. And yes I know you can jump through hoops and fiddle with scary (for ordinary users) bios options to "fix" this. The point is that you shouldn't have to and this is a bit too convenient for MS to keep competitors off laptops.

Basically, what is needed here is a neutral certificate authority not controlled by a single company with a reasonable process for independent operating systems to get a certificate.

I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off.

Arnavion13• 4 years ago

I recently ran into this trying to boot linux on my old imac. Ubuntu actually works but forget about arch, manjaro, and a whole lot of other distributions. Imacs have no off-switch for secure boot that I know off.

Does it also not let you use your own keys? Because if it does, you don't have to turn SB off, just use your key to sign the UKI and a bootloader like systemd-boot. It should work with any distro, especially one that uses dracut to create the initramfs because it's a couple of lines of dracut config to generate a (signed) UKI instead.

jillesvangurp3• 4 years ago

Not in a way that is obvious to me. I'm sure you can work around it but if you just want to boot a live image and run an installer, ubuntu works and not a whole lot of other distributions do (because their installers don't support secure boot). I assume this is because of how much of a PITA it is to get certified.

Kipters3• 4 years ago

Not disagreeing with the general message, but IMHO if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal.

As far as I'm concerned as long as it's possible to re-enable the 3rd Party CA (or disable Secure Boot altogether) it's not tragic considering this only applies to a specific kind of machines ("Secured Core PCs") and not to mainstream ones

jillesvangurp3• 4 years ago

There's a difference between stick in a usb key to fiddle with bios in vendor specific way and then stick a usb key in. It's an extra hurdle.

If your instructions read: "turn off secure boot", MS has already won. Some users will, most won't, and many company IT departments would not allow you to on principle (because it's company hardware and they want it secured because it is their problem if it isn't).

isodev• 4 years ago

What matters more in this instance is the rhetoric and messaging being used. Microsoft is using "Secure-core" as a measurement and indicator of security posture while at the same time installing a Linux-based system somehow detracts from that objective. It's not just a matter of technical ability. Organizations and people, in general, will be exposed to this, which is simply not true. For enterprise IT, this will also mean that by default, they will need to justify alternatives, creating extra friction for competing solutions.

AshamedCaptain30• 4 years ago

if a user is willing to go through the hassle of installing another OS, as easy as it is nowadays, I don't think toggling a bios option is _that_ big of a deal.

It is trivially easy to boot from a USB pendrive; most computers will do it by default if there's no preinstalled OS, many devices have a hotkey you can press/hold which redirects towards booting from USB, and even Windows itself will outright let you do it from the Settings app. You don't even have to interact with the system firmware setup program.

On the other hand, disabling secure boot (or taking ownership of it) is designed to be as difficult as possible, intentionally. Many vendors will actually have a Scary Boot Prompt or the like which makes you double-acknowledge when you change Secure Boot settings, and even reminds you (on every boot) that you have Secure Boot disabled.

It is also unfair by itself that MS OSes will boot without requiring the user to fiddle with the system firmware, but non-MS OSes won't. This puts a glass ceiling on non-MS operating systems regarding how easy their setup flow can be.

mjg599• 4 years ago

This is a brand new ThinkPad. It's not a low-end consumer device, but it's not some niche machine.

feanaro• 4 years ago

We shouldn't allow to inch towards this kind of situation if for nothing else than for not sliding the Overton window in the wrong direction.

It's either a neutral organization signing certs which you then have to accept by default, or you get fined. Those are the only acceptable scenarios.

R0b0t15• 4 years ago

The deal is I want to control the secure boot process so that I can make the OS I choose secure. This is not always an option or possible.

helloooooooo2• 4 years ago

My new Microsoft Surface Book let’s me switch to 3rd party CAs or even none at all, with no problem. This sounds like a Lenovo issue.

On top of that, I would prefer if my machine is by default, in a secure configuration when I buy it. Since the laptops come with Windows pre-installed and Microsoft signed bootloaders, it is fundamentally more secure than if the 3rd parties CAs are enables. I don’t want an attacker chain loading Linux and KVM beneath my Windows OS.

Arnavion13• 4 years ago

I don’t want an attacker chain loading Linux and KVM beneath my Windows OS.

If your Windows install was protected by Bitlocker, and the decryption key was stored in the TPM, and the TPM was set up to require attestation to unseal the key, then such chainloading wouldn't be an issue. (This is also explained in the article.)

BTW, the default for the firmware interface is that it is not password-protected, so even this particular Lenovo device is vulnerable to the evil maid attack you're describing in its "default secure configuration", because the maid can just toggle that option to enable the UEFI CA, or even disable SB entirely. Unless Lenovo is planning to make the UEFI password a required step in their purchase order process, you can expect that the default configuration is going to be an unprotected UEFI. That's why the way to resolve the threat is not to prevent other bootloaders, but to prevent them from reading the data on disk.

cptskippy2• 4 years ago

This sounds like a Lenovo issue.

Lenovo locks down hardware. I tried to upgrade the WiFi card in my Yoga 2 and got an "unauthorized hardware" message from the UEFI and it refused to boot until I removed the hardware.

I would not at all be surprised if they're just over reaching.

downrightmike3• 4 years ago

The real problem is lately we've been seeing malware that lives in UEFI from APT (Edit: Advanced Persistent Threat actor, usually state sponsored) groups. That means it is persistent and will typically disallow updating the UEFI once infected. And almost everyone hates OS updates, and the smallest percentage are willing to update firmware, because it can brick a device, so UEFI isn't going to get updated. This is one of the few things you MUST trust, even if you want to follow zero trust.

legalcorrection3• 4 years ago

the smallest percentage are willing to update firmware

Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.

omegalulw• 4 years ago

I mean sure, but no one is forcing users to install software from APT groups. That's a choice people make. The general point is that you should be able to use hardware for general computing. There can be a switch that by default limits to software signed by your original manufacturer but that should toggleable by the end user.

mjg599• 4 years ago

Macs never implemented UEFI Secure Boot. The Apple-specific Secure Boot can be disabled - https://support.apple.com/en-us/HT208198.

Joel_Mckay8• 4 years ago

Digital-locks like UEFI signing have a singular flaw, in that it only truly offers security to the people holding the signing keys i.e. a firm that did not pay for the computer, shouldn’t be tying unsolicited services to other peoples businesses, and should be classified as an adversarial threat vector.

If Libreboot wasn’t such a pain to install, it would have saved a lot of grief.

jsiepkes7• 4 years ago

in that it only truly offers security to the people holding the signing keys i.e. a firm that did not pay for the computer

That's not true. Practically all servers and more high end motherboards (even my HP zbook allows it) allow you to install your own CA's. Allowing you to create your own trust chain from firmware to OS.

By itself there is nothing wrong with wanting a chain of trust between firmware and OS.

Joel_Mckay8• 4 years ago

Sure.. if you can manage your own keys and still install a normal OS, than you have done 2 things most home PC users will never do… and others simply cannot with a crippled factory BIOS. Yet we are not talking about servers, as features like Backplane administrative subsystems and hot-swapping internal bus parts are not standard on most PCs. Also, the Intel management engine and Computrace decedent features are not always removable, include their own CVE, and companies like Toshiba and Sony would trip the permanent asset flag at the factory forcing end users to adopt features they never asked for.

“chain of trust between firmware and OS” assumes physical security in logistics and co-locations is perfect, and given the number of unsolicited network appliances we would get from vendors in some places I worked... a CA no one ever checks is the least of peoples issues. We avoided HP after the quality dipped for their fragile laptops, and some server firmware would reject generic storage options. ;-)

trelane13• 4 years ago

If Libreboot wasn’t such a pain to install, it would have saved a lot of grief.

Dunno if you need LibreBoot specifically, but if CoreBoot is sufficient, several vendors offer it preinstalled....

Joel_Mckay8• 4 years ago

The models system76 offer are interesting, but as a business choice we are forced to ponder if it makes sense support wise.

lmm• 4 years ago

At what point will mjg59 be willing to write the whole thing off as the anti-Linux measure that most open source fans have realised it is for a decade or more?

jsiepkes7• 4 years ago

Secureboot by itself is needed because otherwise you have no way of making a boot chain from firmware to OS which can be validated on x86. Meaning Linux (servers) also have a use case for it.

I also highly doubt Microsoft sees the Linux desktop as a credible threat to Windows. ChromeOS is an actual threat to Windows. And this does nothing for ChromeOS. It's more likely it's just a poor, uninformed decision from a team at MS.

FeepingCreature• 4 years ago

How big do you think Microsoft's threshold is to fuck a competitor over? It sounds like you're saying Microsoft is slow to rouse to malice; I don't think that's how they work.

If they can head off a competitor early for little investment, I believe they will do so - are doing so.

selfhoster114• 4 years ago

You don't need Secure Boot or PKI for that. Simple proposal:

1. The system includes a TPM. The TPM measures all relevant pre-bootloader firmwares.

2. On first boot, the system firmware hashes the bootloader and stores the hash. A bootloader upgrade may be initiated by the old bootloader at boot time, and will update the stored hash to the one for the new bootloader.,

3. On subsequent boots, the system will refuse to boot unless the user overrides the boot device, the user resets the stored bootloader hash, or the bootloader hash matches. The boot process then proceeds.

4. The bootloader may choose to continue measuring the system and updating the TPM, or skip the process.

This proposal is platform neutral (will work on every platform with a TPM and system firmware), extremely simple to implement, not user hostile, and will not require PKI nor be hostile to users by default.

AshamedCaptain30• 4 years ago

Well, I guess the point of this "collaborateur" deal was that: by making Linux bootloaders and distributions go through the MS vetting, getting most Linux distributions signed by MS, perilous as the situation is, we'd still be getting at least a couple more years of Linux distributions booting hassle-free even on Secure Boot systems. We did get an extra decade at least, as you mention, so I think the "collaborateur" effort was not completely wasted.

The only thing I would demand from these collaborateurs now is _not_ that they apologize, but that they simply make as much noise as possible since it was MS who changed the deal, not them.

blibble• 4 years ago

in 3 years he'll probably be hired by MS as a reward

like Pottering

dredmorbius2• 4 years ago

I'd missed the news. 7 July 2022 for those who did likewise:

https://www.theregister.com/2022/07/07/lennart_poettering_re...

AshamedCaptain30• 4 years ago

The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering. Back when all this Secure Boot was announced, we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated, rather than security enforcement.

"But, you're scaremongering! See, I put this Debian USB pendrive and I can still boot it fine!"

This was because Debian (and many other distros) went, at some point, through MS-enforced hoops in order to get their bootloader signed. Quite a perilous situation in which MS was this "steward" of the entire PC OS ecosystem; whether a Linux distribution booted or not on PCs was practically at the whim of MS. That was at least better than the alternative (no booting -- since MS got away with SecureBoot anyway) and we have to thank people like mjg59 for it.

Now, your Debian pendrive will not boot on this Lenovo PC, even if MS-signed.

"But, you're scaremongering! See, I put this Debian USB pendrive in, hit F1, hit cursor down three times, tab, down five times, space, F12, and I can still boot it fine!"

sgift• 4 years ago

My problem with the position of the "MS is bad" crowd here is that the security reasons are outright dismissed. It's even in the article:

The second is that this is predicated on the idea that removing the third-party bootloaders and drivers removes all the vulnerabilities. In fact, there's been rather a lot of vulnerabilities in the Windows bootloader. A broad enough vulnerability in the Windows bootloader is arguably a lot worse than a vulnerability in a third-party loader, since it won't change the PCR 7 measurements and the system will boot happily. Removing trust in the third-party CA does nothing to protect against this.

Why is it 'all'? Why not 'some' vulnerabilities? Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. And then the whole point breaks down.

AshamedCaptain30• 4 years ago

Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities.

Even if this was true, the fact that this defaults to having the MS signature enabled by default (and the other signatures have to enabled manually) should already make any security-oriented person shiver extensively, considering MS's vulnerability record. At least, it is clearly an (anti-)trust issue, which is already grounds to dismiss the entire idea.

Second, the fact that it may reduce the attack surface by an infinitesimal amount, and not even in paper (since the attack surface is still theoretically the same), is really an argument for it? By the same logic, I can always argue for having 40+-character length passwords and other rather dubious practices, which by definition also improve security -- and these ones at least do so on paper. It's just that security people already know that this infinitesimal improvement just does not warrant the other can of worms that such an approach opens, i.e. it is not worth the trade-off.

And third, there are better ways to reduce the attack surface to an even lower level; ways that do not put a single vendor in control of the security of the entire ecosystem. Claiming "this is one way, we should do it!" is textbook politician's fallacy.

I will note that this crap hasn't worked for Apple when arguing why they should remain an steward of the entire Apple software ecosystem , and it shouldn't work for MS, either.

ahartmetz2• 4 years ago

Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Why spend so much effort on such a relatively useless feature unless there is another reason for it?

pdonis• 4 years ago

it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities.

Ok, so why not allow me to remove the Windows bootloader and just have the third party one that I trust more?

Avamander21• 4 years ago

"But, you're scaremongering! See, I put this Debian USB pendrive in, hit F1, hit cursor down three times, tab, down five times, space, F12, and I can still boot it fine!"

Because yes, one extra option in UEFI settings is the end of Linux on the Desktop. People definitely do not change anything else in UEFI settings ever as Linux users and it's significantly more complex than before. /s

But that's not true, is it? Changing DG or SB toggle is no more difficult than setting the system's clock or boot order. These things are also described in the manual. People installing any OS fresh are likely to have the skillset necessary to do so.

Back when all this Secure Boot was announced, we already said that its main purpose seemed to be to make booting of non-MS operating systems more complicated, rather than security enforcement.

This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve you should be able to see how it as a whole does provide noteworthy security improvements.

Now, your Debian pendrive will not boot on this Lenovo PC, even if MS-signed.

*Please* do go on how you're not scaremongering here or in the previous thread. That sentence is literally false.

AshamedCaptain30• 4 years ago

This is not Secure Boot per se, it is Device Guard. It's quite misleading to call it Secure Boot. If you read up on what Device Guard tries to achieve on Secured Core PC

As clearly mentioned in the TFA, this is Secure Boot itself and has nothing to do with Device Guard.

ziml77• 4 years ago

You still are scaremongering.

Secured core is a class of device security specifically intended to be highly locked down.

From https://docs.microsoft.com/en-us/windows-hardware/design/dev...:

Secured-core PCs provide protections that are useful against sophisticated attacks and can provide increased assurance when handling mission-critical data in some of the most data-sensitive industries, such as healthcare workers that handle medical records and other personally identifiable information (PII), commercial roles that handle high business impact and highly sensitive data, such as a financial controller with earnings data.
For general purpose laptops, tablets, 2-in-1’s, mobile workstations, and desktops, Microsoft recommends using Security baselines for optimal configuration. For more info, see Windows security baselines.

MereInterest4• 4 years ago

I don't see why Microsoft working to make an extremely locked-down class of devices should be taken as evidence that Microsoft isn't working to lock down devices, or that they wouldn't have an incentive to lock down devices.

AshamedCaptain30• 4 years ago

Only when MS allows booting "vetted" non-MS OSes _with the same amount of effort_ as it takes to boot MS OSes (like what they do already in other devices) there is any minimal chance of believing this is for security, and not for pure market control.

If they wanted to have a setting to control whether to block non-MS OSes to boot, they could have put THAT as the hard-to-find option, rather than the opposite. They would not have needed to make an entire class of separate hardware whose only difference is apparently that by default it boots MS OSes only, and who knows how is being pushed behind the scenes.

raxxorraxor• 4 years ago

But it is untrue that these devices are particularly secure, especially compared to the average linux distribution. This is Microsoft marketing and nothing else. On the contrary, the case for security is not to use MS systems because one of the largest threats for industry is industrial espionage and a lot of Microsoft components and data retention cannot be audited.

Boot sector attacks have become quite rare and a sensible threat analysis is the basis of good security. Otherwise you could sell any crap as security. Unplugging your keyboard stops a lot of attacks actually...

hollerith• 4 years ago

The OP is careful and measured. This comment is the opposite.

AshamedCaptain30• 4 years ago

I actually paraphrased a lot of parts from the OP. I guess (guess because you don't mention the reasons why this is "not careful nor measured") you are one of these people who think that as long as there is some key combination that allows a Linux distribution to boot, there is no reason whatsoever to complain ?

Well, sorry, but no. I will sound the alarm way before the only way to install Linux (or any other OS) is to disassemble the laptop and hit some physical switch that will cause a Scary Boot Prompt to be permanently shown on my device, reminding me that I'm booting an "unsupported OS" and that "someone could be doing this to steal my personal data", and requiring me to acknowledge it by waiting 30 seconds before it proceeds to boot my actual OS. Every Single Time I boot the device. I will complain loudly way before we reach that on PCs.

Cause that's exactly what I had to do to run Linux on a Chromebook. And Google also seems to think that because they allow me to run some Linux distros under a heavily curtained container inside their OS, "all's good". Google does not get a free pass from me, why should MS?

zahllos2• 4 years ago

Agree. There's separate issues at play: the mechanism, what value it adds or subtracts and how it can be used. The critical component is allowing end users to control their own devices.

Fair disclosure, I've been involved in products supporting secure boot, have run my own laptop with my own keys such that only my signed stuff runs. I also have one of those Talos 2 boards and it also supports its own secure boot, even though all of the software all the way down to the firmware is open source.

So far Microsoft have actually been pretty reasonable: they enabled the shim in the first place. No Linux distros including heavyweights like Redhat or Canonical stepped up to undergo the requirements for default inclusion in the UEFI forum.

It always strikes me as a logical fallacy to argue against having a secure boot but then be pro end to end encryption. 'Secure boot is being used to oppress us therefore secure boot is bad' is as extreme a view as 'some awful human beings share csam so end-to-end bad'.

Ultimately in both cases the problem is societal and not technical. We need consumer rights protections so we don't end up renting our devices, and we need policing and community work to eradicate csam. Frothing at the mouth misinformed 'activism' comes across very badly to people outside the tech world we necessarily need to engage to make constructive policies for the future.

jeroenhd6• 4 years ago

Allowing the Linux bootloader is a security risk for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them, so the excellent rootkit protection secure boot provides gets wiped out entirely the moment you grab a copy of grub with your own chain loader. This is possible because a vulnerable version of Grub got signed at some point that allows loading unsigned code.

Secure boot should always be possible to turn off, and it should always be possible to load your own keys. I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot. It defeats the entire point of requiring higher-than-kernel level permissions to alter the boot sequence.

Linux needs better secure boot key management features if it's serious about making secure boot work. Without it, just turn it off. It's a bit of a pain for new Linux users, but so is every other step of the way.

AshamedCaptain30• 4 years ago

for consumer Windows devices. Microsoft foolishly doesn't enable Bitlocker on them

Actually, Microsoft enables Bitlocker on many if not most consumer devices. For example, I have not been able to find a laptop without Bitlocker enabled by default since the Windows 8.1 era. Even home editions of Windows enable bitlocker by default, even if they don't call it Bitlocker (they call it "Full device encryption" or the like). On desktops the situation is the opposite -- until recently, most desktops didn't even ship with a TPM at all.

Nowadays TPMs are a requirement for Windows 11, so devices with Bitlocker disabled by default are going to be a minority.

I don't see the point of keeping it enabled on Linux if all of its protection can be disabled by editing a file on /boot.

That's not true -- if a distribution is shipping a signed bootloader binary, then there should be no way to use that distribution's bootloader to run an unsigned binary. In fact, it would be considered a security vulnerability and the corresponding bootloader binaries would be blacklisted by Microsoft. It has happened in the past: https://www.suse.com/support/kb/doc/?id=000019892 . The default behavior of most distribution's GRUB2 (and specially whenever it is pre-enrolled into a signed shim) is that when you boot under Secure Boot it will check the signature on any UEFI executable, GRUB module, or Linux kernel you try to boot, and refuse to boot if it is not in the (UEFI firmware/shim) whitelist.

Linux needs better secure boot key management features if it's serious about making secure boot work.

Linux already has multiple secure boot key management facilities. And then there's shim.

But in any case, the problem is that Microsoft itself should be required to face these problems; under no circumstance should it be that by default MS gets their signatures to work for free but everyone else needs to have extra UI to manage them.

NotEvil• 4 years ago

You might wanna read the article. It argues the very point you are making.

ho_schi2• 4 years ago

Turn SecureBoot off. Secure the UEFI and harddrive itself!

Requirements

State of he art UEFI implementation and usually a harddrive from the professional series. In case of a ThinkPad it should be possible for more than a decade.

How To

   1.) Set an UEFI-Password to protect the UEFI (formerly BIOS) itself
   2.) Set a Harddrive-Password within the UEFI, which requires a harddrive with built-in encryption

This protects the UEFI itself from manipulation, the bootloader, the kernel and the howl system. It is simple, therefore less error prone. Transparent to the operating-system, therefore any operating system is supported. It doesn't affect performance because professional harddrives actually encrypt always all data - they just don't ask for a key. You need to trust into the UEFI implementation and the harddrive manufacturer, which you hopefully do.

Bonus

No Certificate Authority (CA) and certificates involved. This reduces the error surface because it is error prone. You could even add LUKS (or whatever you prefer) on top of it. Because of the transparent built-in encryption you will not have a conflict. Probably a touch too much? But upon your decision.

https://support.lenovo.com/ie/en/solutions/ht002240

mjg599• 4 years ago

The devices we're talking about here all have Bitlocker enabled by default.

pjmlp7• 4 years ago

As someone that started with 8 and 16 bit computers, I am fine with single purpose computers.

Instead of giving money to Microsoft or Apple, support OEMs producing hardware with Linux pre-installed like Tuxedo and System 76.

chithanh• 4 years ago

That is not the point. The point is by employing dark patterns, Microsoft makes it progressively more difficult for normal users to switch away from Microsoft.

Want to switch default browser? Adding yet one more step to stop you.

Want to boot other operating system? Now you have to go to UEFI setup and change boot settings.

etc.

NeutralForest• 4 years ago

This is correct of course but we can't ignore that Windows computer are ubiquitous nowadays. Alternatives like Tuxedo or System76 are either pricier or are missing options such as keyboard layouts, delivery to non US/CAN/AUS and European countries, world wide support (in your language). Also, people just know Windows. Those issues might go away in time but there's non-zero friction to acquiring Linux hardware imo.

pseudalopex• 4 years ago

As someone that started with 8 and 16 bit computers, I am fine with single purpose computers.

No one should complain about regressing 30 or 40 years?

boesboes• 4 years ago

As a former system-76 owner: it just sucks they are such low quality. All plastic, worse thermals then a 2018 mac book. Couldn't even decode a 720p youtube video without burning up. System 76 just rebrands some shitty chinese laptops and you notice.

I tried not giving money to apple, but it was money wasted tbh. Like seriously, $2k for a barely useable laptop.

trelane13• 4 years ago

The wider problem is that, as long as Microsoft is superdominant in the PC market, Linux OEMs will still be affected by Microsoft's decrees, because they don't (yet?) have the influence of Apple to get fully custom hardware.

MereInterest4• 4 years ago

As someone that started with 8 and 16 bit computers, I am fine with single purpose computers.

I'm also okay with single-purpose computers. Like the computer in the thermostat that controls the boiler, or the timer for the sprinklers. An OS-locked computer is still a general-purpose device, and describing it as "single purpose" muddies the waters.

Instead of giving money to Microsoft or Apple, support OEMs producing hardware with Linux pre-installed like Tuxedo and System 76.

Why is this an "XOR" instead of "AND"? I prefer purchasing from OEMs that provide pre-installed Linux, AND I find it morally repugnant when manufacturers assert ownership over a device after having sold it.

userbinator• 4 years ago

The worst problem is that people are (even in the other discussion thread here on HN) still claiming that we are scaremongering.

Remember what some people on here (and elsewhere) work for. They either truly believe advancing the authoritarian corporatocracy is a good thing, have been brainwashed into doing so, or are just happy to have a job. These are the true enemies of your freedom.

Some of us saw this coming endgame ever since the "Trusted Computing" movement started, and how they slowly drowned out their opposition with propaganda. "Security" has become the go-to excuse for having their way with their power. The infamous Franklin quote has certainly taken on a new meaning.

pydry• 4 years ago

I dont think it's a concerted effort to support corportocracy think it's just the just world fallacy.

It happens in all sorts of other domains too - the tendency to believe that things, by default, are the way they are for good and just reasons is strong in most people.

DoctorOetker• 4 years ago

I need an explicit list of public keys corresponding to the hardware roots of trust. From the article and prior reading it seems to be the hardware vendor's. Or are these in turn signed by Intel, AMD, ARM, ...?

i.e. which public key is actually burnt in the processor's eFuses?

A cryptographic break can always happen, and in such a cryptographically apocalyptic event i'd prefer to be able to author, sign and boot a minimal bootloader myself.

Have people ever gathered such listings?

EDIT: a secondary reason for maintaining such lists: key compromise can always happen, knowing when you need to replace your processor / computer because of a fundamental compromise would be mandatory. Also when buying hardware being able to observe historically compromised keys by vendor could give an indication of their security discipline.

nimbius• 4 years ago

while i absolutely agree with this sentiment, i feel like "Microsoft" as a boogeyman has become far more toothless since secureboot first took flight in 2006. the same people who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses.

in 2022 there isnt an single manufacturer that doesnt offer (albeit sometimes sporadically) a Linux laptop. system76 and others exist to deliver the linux laptop and desktop, and Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease.

Battlestation vendors like Asus will likely seek the rubber stamp for their laptop products that ship with windows, but for liquid cooled battle station geeks the same motherboards will ship with open EFI to run whatever keys you want to, or dont.

AshamedCaptain30• 4 years ago

Google flat-out refused to do any EFI on chromebook because, surprise, it wasnt really necessary. The average chromebook in 2022 has a cogent enough arm processor to handle daily compute on a wide variety of distros with ease.

Google is in no way a model to follow. They actually make it more complicated to install _native_ Linux than x86 PC manufacturers, what with their "developer mode", often ridiculous, physical hardware manipulation requirements to enable it, and non-removable Scary Boot Prompts unless you completely overwrite the full system firmware. In other words: Google is actually worse right now than MS would be on x86 even if they MS extended this Secured Core crap to all other PC manufacturers. It doesn't matter much that they use open-source firmware if they lock it down worse than the rest.

And "containerized Linux" like Crouton misses the point and anyway MS is doing it too! (so much for those who say MS does not care about the Linux desktop market share).

trelane13• 4 years ago

those who clamored and wailed about secureboot on windows laptops snored through most of Apples worst laptop freedom offenses.

I've never had to buy an OSX computer in order to install linux on top of it. The same cannot be said of Windows.

cptskippy2• 4 years ago

Does Google use Secure Boot on it's Chromebooks? Are you able to install whatever you want on them?

bejelentkezni• 4 years ago

Debian's images are not Secure Boot signed. You made that up.

phkahler3• 4 years ago

I think they said the Debian boot loader was, not the whole OS image.

mjg599• 4 years ago

Debian has shipped with a signed bootloader since version 10, released over 3 years ago.

phendrenad23• 4 years ago

It's not even scaremongering at this point, it's just expired. Every 5 years or so something like this comes up, and it's used as another data point in the slippery slope that you all are so sure is happening. And yet, if I buy any random PC off the shelf in 2022, there's still a huge chance that it'll boot from a Linux ISO without having to jump through any hoops.

I think what's happening is, at some point in the past someone decided that there was a conspiracy to lock out Linux, and while that future hasn't come to pass, the total number of Linux-compatible devices keeps expanding, and therefore we keep getting examples of vendors locking things down too hard. These appear to be examples of the trend, but they're an increasingly small percentage of the total pool of Linux-compatible devices. It's the same thing that happened with Android. You can still root most phones, despite some being locked down. Things have reached an equilibrium. As I said in another post "there are more forces than Microsoft at work here".

michaelt3• 4 years ago

Given the association with the secured-core requirements, this is presumably a security decision of some kind. Unfortunately, we have no real idea what this security decision is intended to protect against.

Isn't secure boot attempting to protect against 'evil maid' attacks?

After all, the evil maid can come in on Day 1 and insert a bootable USB stick which boots a linux distro customised to look like the normal Windows boot and save your password when you enter it; then on Day 2 boot the computer normally and use that password.

If you want to protect against that, you need password-protected BIOS settings to enable/disable booting third-party code.

(Personally I see adopting the TPM as a fool's errand - I don't think it can ever deliver on its promises)

phh2• 4 years ago

If you can't modify victim's computer itself, just do that on another computer?

The evil maid will need less time to replace the computer with another one that looks alike the original one, than to install a Linux distro

dotancohen• 4 years ago

The maid could even install a USB keylogger, if the goal is compromising just the credentials.

3233• 4 years ago

The standard response is that after entering the password the user will notice that the boot fails to complete to the expected Windows instance. In a high security environment this boot failure should immediately be flagged and investigated and the machine considered compromised.

michaelt3• 4 years ago

Just chuck up a screen saying "Configuring update for Windows, do not turn off your PC" and reboot 2 minutes later.

There's now no evidence of compromise except a user saying "My computer rebooted unexpectedly, there was a message about windows update" - hardly something that's going to set alarm bells ringing.

phendrenad23• 4 years ago

Yes, it's likely to stop evil maid attacks. But keylogging is just one attack vector. If you can boot to Linux, you can clone a copy of the user's data, to be decrypted with a cluster off-site.

peter_retief• 4 years ago

I do not want to ever use Microsoft software, why do I need a Microsoft certified key to use my own hardware?

Big question is how do Microsoft get away with this bullying of hardware manufactures, probably the fear of losing business.

What can we do to stop this?

onli• 4 years ago

The moment systems like TPM and secureboot were added it stopped being our hardware. We said as much back then, sabotage like described here show that analysis was right.

There is nothing that can be done as long as there is a processor duopoly that follows these ms requirements.

jeroenhd6• 4 years ago

What's the problem with TPMs? Do you mean the Intel ME/AMD PSP or is there an anti hardware key movement out there that I don't know about?

jeroenhd6• 4 years ago

You can buy the Linux editions of your hardware, at least for laptops, to show that there's a real need for Linux support out there, however small it may be in practice. Or you can buy System76 or similar hardware to guarantee actual Linux compatibility rather than the manufacturer saying "it boots so let's ship it".

selfhoster114• 4 years ago

If I had to pay 2x the retail price for Linux compatible hardware, I'd have never gotten into Linux as a teenager with no money and no access to special hardware.

pjmlp7• 4 years ago

Instead of giving money to Apple or Microsoft, you give it to Linux OEMs.

denton-scratch• 4 years ago

This seems to be MS's response to a rather serious mistake in GRUB2 - a howler, I'd say.

I've never liked GRUB2 much. The configuration seems to freely mix executable code and data, which makes me tremble at the prospect of altering it. And I find it much harder to understand than GRUB Legacy (and that's saying something).

password4321• 4 years ago

I recently learned about EFISTUB thanks to https://news.ycombinator.com/item?id=31231968&p=2#31234648

Load Linux directly as an EFI executable via the EFISTUB approach.
the "Using UEFI directly" section [...] https://wiki.archlinux.org/title/EFISTUB

ysnp• 4 years ago

But unfortunately the 2022 requirements don't seem to be publicly available, so it's difficult to know what's being asked for and why.

Where can we find the full requirements for a device to be Secured-core?

james-redwood• 4 years ago

The lack of transparency over the definition of 'secured-core' is disturbing.

bitwize• 4 years ago

We're now at the final stage of conspiracy theory damage control with respect to the idea that Microsoft is trying to lock down the PC platform and prevent non-Windows operating systems from booting:

1. It's not happening, I don't know what you're talking about, anybody who believes that has been radicalized by Russian propaganda

2. Well, yeah, maybe it is happening here and there, but it's no big deal, and it's certainly not through a coordinated effort on our part

3. Yes, it's happening, it's been happening all this while, and here's why it's a good thing <-- we are here

We all will have to reckon with the fact that general purpose computing is going bye-bye. The interests of OEMs and ISVs in delivering a safe, consumable experience to end users are aligned against allowing unsigned, unapproved software from running. And yes, the OEMs, ISVs, and probably most of the consumer market will believe that this is a good thing. The next big thing is remote attestation: the internet will simply stop working properly on your machine unless it can prove that it is running an approved OS and application stack.

option_key• 4 years ago

You don't understand! Nadella's Microsoft open-sourced a few applications and created a popular text editor, which makes him basically the second coming of Christ in the eyes of a large portion of HN users.

Their numerous anti-user and anti-privacy practices are unimportant. Nadella's Microsoft is "cool" and that's all that matters.

fredgrott• 4 years ago

Does this reflect the same sort of issues in the browser password protection space, i.e. Since last year chrome by default links to google password protection in short words you have to do extra steps to link google accounts to non-google Chrome browsers.

They say security but there is an underlying Elephant in the room concern that keeps rearing it's head.

xenophonf• 4 years ago

The apparent secured-core requirement for 2022 is that [...] out of the box, these systems will not boot anything other than Windows.

I don't see how anyone can look at the history of Microsoft and not immediately judge this as being completely anti-competitive in nature.

sylware• 4 years ago

Accute evil, what did you expect?

NoGravitas• 4 years ago

I'm shocked. Who could ever have foreseen Microsoft doing such a thing?

nvr219• 4 years ago

Re this website itself: Love seeing LiveJournal code base still in use.

CaliforniaKarl• 4 years ago

Kindof off-topic, but…

whenever a signed object is booted by the firmware, the trusted certificate used to verify that object is measured into PCR 7 in the TPM.

Is there a list somewhere of what each PCR is generally used for? I’ve had difficulty finding the information through Google searches.

mjg599• 4 years ago

https://trustedcomputinggroup.org/resource/pc-client-specifi... is the spec for this on PCs.

dang• 4 years ago

Recent and related:

Lenovo shipping new laptops that only boot Windows by default - https://news.ycombinator.com/item?id=32023868 - July 2022 (388 comments)

zzo38computer• 4 years ago

Secure boot is one problem with UEFI but it is not the only problem.

rob_c2• 4 years ago

Why is this being moaned about because of one bad machine _again_.

As much as i love to lay into Microsoft I see little reason to yet, other than speculation and corporate bad practice brought on by massive corporate incompetence, no grand conspiracy…

Responsible stewardship of the UEFI Secure Boot ecosystem

Related Stories