The State Of Linux Distributions Handling SecureBoot

[mjg59]

Make /boot and / RO.

Doesn't help. If someone's gained root access they can just modify /dev/sda directly.

CRC the /boot partition and make independent system check-verify it, before booting it.

That'd work, though you'd want to use a cryptographic signature instead of a CRC - it's easy to force a CRC to match. The easiest thing to do would be to have the firmware verify the signature, that way you don't need a second computer to verify your laptop every time you want to boot it. And... you've just reinvented Secure Boot.

[duby229]

So, please tell me how Linux is magically safe from viruses that install themselves to the bootloader...

The reality is that these viruses can target any operating system, Linux included. Secure boot protects Linux just as effectively as it does windows, the only problem that is getting seriously discussed is that it may be difficult to load custom keys into the trusted keys list. (Notice that I said 'may', there is no guarantee that it will be difficult on all or even the majority of systems)

Go ahead and name one... Just one... where by the method of infection is through a booted linux system....

[ShadowBane]

Go ahead and name one... Just one... where by the method of infection is through a booted linux system....

Really, any of the remote root exploits listed here would allow the installation of bootloader viruses...
http://www.exploit-db.com/platform/?p=linux

Bootloader exploits are attractive because they are very hard to detect from a booted computer. There is no reason to expect that people using Linux would never be targeted by such attacks.

[duby229]

Doesn't help. If someone's gained root access they can just modify /dev/sda directly.



That'd work, though you'd want to use a cryptographic signature instead of a CRC - it's easy to force a CRC to match. The easiest thing to do would be to have the firmware verify the signature, that way you don't need a second computer to verify your laptop every time you want to boot it. And... you've just reinvented Secure Boot.

Getting root access on linux is horribly difficult to do without the password. If you dont believe me then try it for yourself.

[dashcloud]

If you boot Windows 8, You must use secureboot. How is that not forced?

If it really was a mechanism to protect against boot viruses.... Shouldnt it look for boot viruses?

I don't like to say this to people, but you are an idiot. How do you know what a boot virus looks like? You can certainly detect all the current known ones, but how do you defend against future ones and variants of current ones? Do you provide updates? If so, how do the updates get done?
If you go down this path, you've re-invented the modern virus scanner- only worse, as you probably have to put this in a chip, not on a disk, and come up with a way to safely & securely update it. Definition-based virus scanners are great at detecting current and old viruses, but not near-future, and tomorrow's viruses/etc.

The problem is if you can install any operating system on the machine, you can subvert any operating system on the machine.

[duby229]

Really, any of the remote root exploits listed here would allow the installation of bootloader viruses...
http://www.exploit-db.com/platform/?p=linux

Bootloader exploits are attractive because they are very hard to detect from a booted computer. There is no reason to expect that people using Linux would never be targeted by such attacks.

OK so then lets come up with a native solution. We damn sure dont need MS to decide that since linux can get a boot virus we should just prevent it from booting. I'll promise you that windows can get a boot virus. So lets just prevent -IT- from booting.

But see that's my point... MS does --NOT-- need to worry about whether or not linux can get targeted by such attacks... It isnt their concern at all. Not even a teeny weeny tiny little bit.

EDIT: MS can come up with whatever excuses they want, but they will never be able to come up with enough excuses to give them the right to determine what linux is acceptable to boot from.

[duby229]

I don't like to say this to people, but you are an idiot. How do you know what a boot virus looks like? You can certainly detect all the current known ones, but how do you defend against future ones and variants of current ones? Do you provide updates? If so, how do the updates get done?
If you go down this path, you've re-invented the modern virus scanner- only worse, as you probably have to put this in a chip, not on a disk, and come up with a way to safely & securely update it. Definition-based virus scanners are great at detecting current and old viruses, but not near-future, and tomorrow's viruses/etc.

The problem is if you can install any operating system on the machine, you can subvert any operating system on the machine.

How many more times do I need to say this? How many different ways can it be said?

THATS NOT OUR PROBLEM!!!

If MS is so worried about their OS, then let them worry about their OS.

EDIT: sometimes you gotta do what you gotta do. The thing about freedom is that you're frre to do whatever you want to do as long as you're not stepping on somebody elses freedoms...

EDIT2: And about subverting an OS... That will always be true. Secureboot is not going change that. MS OSes have been by far the worst offenders. Windows 8 is -not- going to be exception. It will get infected just as badly as the rest of them have. Secureboot wont fix that. The only thing it does is give MS the ability to decide what OSes are acceptable to boot and which ones arent. THAT is NOT their place. What they need to do is ban the worst offenders... But that would fuck themselves.

[mjg59]

Getting root access on linux is horribly difficult to do without the password. If you dont believe me then try it for yourself.

Yeah, it's horribly difficult to modify your .bashrc to alias sudo to something that steals your password. But honestly? I'm a kernel developer. I work on security-related topics. I have a pretty solid idea of how frequently new exploits are found that permit code to be executed as root even without tricking you into handing over your password.

[crazycheese]

Doesn't help. If someone's gained root access they can just modify /dev/sda directly.

First, they need to do that. That's what other layers are up to.
Second, even if have done that, they only defeated one layer. They can't inject kernel code, only in userspace. And userspace can be CRCed as well - but thats outside even of SecureBoot scope.

That'd work, though you'd want to use a cryptographic signature instead of a CRC - it's easy to force a CRC to match. The easiest thing to do would be to have the firmware verify the signature, that way you don't need a second computer to verify your laptop every time you want to boot it.

By "CRC" I meant "hash", not as particular hashing algorithm like CRC32 etc.
It is possible to check by system hardware, if its prone to bugs, which it isn't. So its better to use independent system, connecting only for time of pre-boot checks as RO.

And... you've just reinvented Secure Boot.

There is minor difference and a small attribute that you are sure aware of.

The difference is that my "version" does not require you to "surrender" to me or be executed.

The small attribute is that my "version" was "invented" in 10 seconds of time, and I sure have read about it 2-3 years ago on the network. That means, it is already used in production.

And also, if case anyone with ideas browsing, the whole idea above is Defensive Publication at date/time of original post.
So don't even try.

[mjg59]

How many more times do I need to say this? How many different ways can it be said?

THATS NOT OUR PROBLEM!!!

If MS is so worried about their OS, then let them worry about their OS.

Again, please describe a solution that Microsoft could have used to prevent bootloader malware without also preventing booting of unsigned Linux. They worried about their OS. They came up with a solution that works for their OS. If you don't like their solution, describe a better one.