Announcement

Collapse
No announcement yet.

The State Of Linux Distributions Handling SecureBoot

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • #71
    Originally posted by dashcloud View Post
    So, how do you stop a rootkit that installs a tiny Linux system, enough to boot, change stuff outside of Window's view, and ensures it always is loaded, and undetectable (because if you control the bootchain, your part of the disk could always be before the start of the disk, or after the end).

    One option is to not allow anything else to be installed, and never let your OS be in a position to have the bootloader changed.

    If you do want to allow system-level changes, or something like dual-boots, or even other OSes, you need a way to make sure only "good" operating systems and programs can make those changes.

    Another way to look at it is, how can you make sure the user is in control of the dual-booting, if it's possible for the user to not even be aware they are dual-booting/something has changed?
    If the boot loader gets overwritten in linux it's just a matter of firing up grub. Dual boot works just fine as is thank you. It certainly isnt linux's fault that windows doesnt have a boot loader comparable to grub.
    Last edited by duby229; 28 December 2012, 08:59 PM.

    Comment


    • #72
      Originally posted by duby229 View Post
      If the boot loader gets overwritten in linux it's just a matter of firing up grub. Dual boot works just fine as is thank you. It certainly isnt linux's fault that windows doesnt have a boot loader comparable to grub.
      But you haven't answered the important question: what if the bootloader gets changed, and you don't know because things work exactly the same, except for a small change?
      Wouldn't you like to know your system isn't your system anymore, but someone else's?

      Comment


      • #73
        But now you're stretching. Secureboot will not do that for you. It looks for a signature and if it finds it, it boots. It doesnt look for hashes or modifications or viruses or anything else.. All that needs done is to make sure the signature exists. It may not have been done yet, But I'm absolutely positive it will. Everything MS does gets hacked.. You think this will be any different?

        I'll bet that in 2 years from now there will be more boot viruses than ever before -simply- because secureboot provided the temptation.
        Last edited by duby229; 28 December 2012, 09:16 PM.

        Comment


        • #74
          Originally posted by duby229 View Post
          I'm tired of trying new ways to say the same thing.... So I'll just say it the exact same way....

          THATS NOT OUR PROBLEM!!!

          IF MS is worried about their OS, then let them worry about thier OS. Leave ours alone please.
          You're damn right Linux is not their problem.

          That's why they are under no obligation to make sure Secure Boot plays nice with Linux. They're just looking out for Windows. Which is PRECISELY what they are doing with Secure Boot.

          Just like you don't care about Microsoft and Windows, Microsoft does not need to care about Linux users having issues with Secure Boot. Except that they ARE by offering signing services. Garett managed to get his shim signed by Microsoft, and that shim is now freely distributed to everybody and it forms the basis for the bootloaders used by Ubuntu, Fedora and SuSe (no word on OpenSUSE yet).

          But then again, most idiots in the Linux world can't even see beyond the year 2002. Thank god I jumped from Fedora 17 to Windows 8 as soon as it came out. Pure hardware bliss without the stinking political 'free shit' baggage.
          Last edited by Sonadow; 28 December 2012, 09:37 PM.

          Comment


          • #75
            Originally posted by duby229 View Post
            But now you're stretching. Secureboot will not do that for you. It looks for a signature and if it finds it, it boots. It doesnt look for hashes or modifications or viruses or anything else.. All that needs done is to make sure the signature exists. It may not have been done yet, But I'm absolutely positive it will. Everything MS does gets hacked.. You think this will be any different?

            I'll bet that in 2 years from now there will be more boot viruses than ever before -simply- because secureboot provided the temptation.
            Anything that modifies the bootloader or the boot process will cause a change in the pre-boot signature.

            Comment


            • #76
              Originally posted by Sonadow View Post
              You're damn right Linux is not their problem.

              That's why they are under no obligation to make sure Secure Boot plays nice with Linux. They're just looking out for Windows. Which is PRECISELY what they are doing with Secure Boot.

              Just like you don't care about Microsoft and Windows, Microsoft does not need to care about Linux users having issues with Secure Boot. Except that they ARE by offering signing services. Garett managed to get his shim signed by Microsoft, and that shim is now freely distributed to everybody and it forms the basis for the bootloaders used by Ubuntu, Fedora and SuSe (no word on OpenSUSE yet).

              But then again, most idiots in the Linux world can't even see beyond the year 2002. Thank god I jumped from Fedora 17 to Windows 8 as soon as it came out. Pure hardware bliss without the stinking political 'free shit' baggage.
              And THAT is exactly the problem. How many linux distro's are -not- listed. How many exactly? All I see are the ones that could pay them off.

              You can use whatever OS you prefer to use. What ever floats your boat. Anything that tickles your tonsil. As long as I'm allowed the same freedom please.
              Last edited by duby229; 28 December 2012, 10:31 PM.

              Comment


              • #77
                Originally posted by Sonadow View Post
                Anything that modifies the bootloader or the boot process will cause a change in the pre-boot signature.
                And as I said, I'll bet it gets hacked. In 2 years from now there will be more boot loader viruses than ever before -because- of secureboot. Simply because it provided a target. Fresh meat and all that jazz. The overubundance of opportunity will prevail. I'm sure of it.

                Hell If I ever get to the spot that I can't get my favorite OS to boot because of secureboot, I'm sure I'll be involved with the crowd that is hacking it.

                EDIT: I can't even begin to imagine all of the un-hackable protection schemes that have been hacked. My favorite has got to be AACS though. It took some time, but guess what happened...... Now I can --FINALLY-- play my bluray movies on my media center. It's just one example of many where the dumb ass shit that corporate america does gets pushed into there dumb ass faces. I'm sure MS is going to be eating their own shit when this gets shoved so far up their ass that they can taste it.
                Last edited by duby229; 28 December 2012, 10:48 PM.

                Comment


                • #78
                  Originally posted by duby229 View Post
                  And as I said, I'll bet it gets hacked. In 2 years from now there will be more boot loader viruses than ever before -because- of secureboot. Simply because it provided a target. Fresh meat and all that jazz. The overubundance of opportunity will prevail. I'm sure of it.

                  Hell If I ever get to the spot that I can't get my favorite OS to boot because of secureboot, I'm sure I'll be involved with the crowd that is hacking it.

                  EDIT: I can't even begin to imagine all of the un-hackable protection schemes that have been hacked. My favorite has got to be AACS though. It took some time, but guess what happened......
                  Cryptographic signatures have been important enough to be a target for a long time, and from time to time flaws are founnd in them. They are not, however, common things to have broken and there is no reason to believe that secure boot will make cryptography be broken sooner.

                  Comment


                  • #79
                    It's a basic law of physics. If there are 10 computers with secureboot running on it, then the opportunities for finding flaws are limited. If there are 85,000,000 computers running it, then the abundance of opportunity will prevail. At least some of those computers will exhibit qwerks that will be learned from and adapted.

                    Comment


                    • #80
                      Originally posted by duby229 View Post
                      I'm sure MS is going to be eating their own shit when this gets shoved so far up their ass that they can taste it.
                      Your ignorance is showing.

                      SecureBoot is not a Microsoft creation. Never has, never will. It's part of the UEFI standard that was formally agreed upon and pushed out to all mainboards in the last 2 -3 years. Microsoft is only the first company to require Secure Boot for its operating system.

                      If you have a problem with that, take it up to the UEFI board, not Microsoft. As far as Microsoft is concerned, they have already fulfilled their obligations by making sure that all x86 machines will have an option to allow the enrolling of custom keys into the Secure Boot signature list (by providing the signing service nobody wants to offer) and stipulating that x86 machines must provide the ability to turn off Secure Boot.

                      The options are already there. If Linux users love to proclaim that they will pay for Free software, it's time for them to put their money where their mouth is and donate to their distro of choice so that the maintainers can raise the one-time $99 fee (which goes to VeriSign, NOT Microsoft) to get their bootloader signed and ensure that the distro will play nice with Secure Boot.

                      Lastly, Garett is not stopping any distribution from using his shim. So in all respects the solution is already out there and ready to be used, just like how Ubuntu, Red Hat, Fedora and SUSE have already started using Shim. Unfortunately, the desire for 'my own solution because I don't want to use someone else's work which is already freely available because my ego is too big', an over-inflated sense of entitlement, along with the fanboy hate for Microsoft blinds everyone to the immediate solution already made available.

                      One last thing: Linux is not about market share? Not in this corporate world. If you want to be taken seriously by OEMs and hardware vendors or even have the clout to overturn asinine decisions like Secure Boot, market share is a must-have. Get that desktop market share from 1.4% up to at least 10% and I can assure you Microsoft will have to think thrice when stipulating hardware conditions for OEMs for subsequent versions of Windows in the future.
                      Last edited by Sonadow; 28 December 2012, 11:54 PM.

                      Comment

                      Working...
                      X