lkml.org 
[lkml]   [2012]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC] Second attempt at kernel secure boot support
From
Date
On Thu, 2012-11-01 at 14:49 +0000, Matthew Garrett wrote:
> On Thu, Nov 01, 2012 at 02:42:15PM +0000, James Bottomley wrote:
> > On Thu, 2012-11-01 at 10:29 -0400, Eric Paris wrote:
> > > Imagine you run windows and you've never heard of Linux. You like
> > > that only windows kernels can boot on your box and not those mean
> > > nasty hacked up malware kernels. Now some attacker manages to take
> > > over your box because you clicked on that executable for young models
> > > in skimpy bathing suits. That executable rewrote your bootloader to
> > > launch a very small carefully crafted Linux environment. This
> > > environment does nothing but launch a perfectly valid signed Linux
> > > kernel, which gets a Windows environment all ready to launch after
> > > resume and goes to sleep. Now you have to hit the power button twice
> > > every time you turn on your computer, weird, but Windows comes up, and
> > > secureboot is still on, so you must be safe!
> >
> > So you're going back to the root exploit problem? I thought that was
> > debunked a few emails ago in the thread?
>
> The entire point of this feature is that it's no longer possible to turn
> a privileged user exploit into a full system exploit. Gaining admin
> access on Windows 8 doesn't permit you to install a persistent backdoor,
> unless there's some way to circumvent that. Which there is, if you can
> drop a small Linux distribution onto the ESP and use a signed, trusted
> bootloader to boot a signed, trusted kernel that then resumes from an
> unsigned, untrusted hibernate image. So we have to ensure that that's
> impossible.

But surely that's fanciful ... you've already compromised windows to get
access to the ESP. If you've done it once, you can do it again until
the exploit is patched. There are likely many easier ways of ensuring
persistence than trying to install a full linux kernel with a
compromised resume system.

If this could be used to attack a windows system in the first place,
then Microsoft might be annoyed, but you have to compromise windows
*first* in this scenario.

James




\
 
 \ /
  Last update: 2012-11-01 21:41    [W:0.170 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site