- cross-posted to:
- linux@programming.dev
- hackernews@lemmy.smeargle.fans
Follow up to: “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
SBAT was developed collaboratively between the Linux community and Microsoft, and Microsoft chose to push a Windows update that told systems not to trust versions of grub with a security generation below a certain level. This was because those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain, and we’ve seen real world examples of malware wanting to do that (Black Lotus did so using a vulnerability in the Windows bootloader, but a vulnerability in grub would be just as viable for this). Viewed purely from a security perspective, this was a legitimate thing to want to do.
…
The problem we’ve ended up in is that several Linux distributions had not shipped versions of grub with a newer security generation, and so those versions of grub are assumed to be insecure (it’s worth noting that grub is signed by individual distributions, not Microsoft, so there’s no externally introduced lag here). Microsoft’s stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. Unfortunately, as is now obvious, that didn’t work as intended and at least some dual-boot setups applied the update and that distribution’s Shim refused to boot that distribution’s grub.
…
The outcome is that some people can’t boot their systems. I think there’s plenty of blame here. Microsoft should have done more testing to ensure that dual-boot setups could be identified accurately. But also distributions shipping signed bootloaders should make sure that they’re updating those and updating the security generation to match, because otherwise they’re shipping a vector that can be used to attack other operating systems and that’s kind of a violation of the social contract around all of this.
You must log in or register to comment.
So they claimed it wasn’t supposed to affect dual boots, yet it was specifically to patch a vulnerability in GRUB, something a Windows-only user has no reason of ever using (that I’m aware of)?
So how could this have affected anyone but people who dual boot? Sketchy.
It’s funny how often Microsoft manages to accidentally do things that just happen to make life more difficult for Linux users. They sure do seem to have bad luck with that.
I don’t think Microsoft cares that much anymore. The OS wars are over.
Every Windows now ships with a one-button Linux installer.
Powershell has default aliases so you can use bash commands for basic stuff.
Microsoft is one of the top contributors to the Linux kernel.
They provide documentation on how to install Linux.
They have published a Linux distro.They don’t care cause that’s not where they make their money. Their focus is on keeping their market dominance in Office, Exchange and AD, or M365, Exchange Online and Entra, respectively (all of which can be accessed from Linux). With those products, they can basically demand a tax of ~$20-30/month/employee from every business in the world.
In fairness, anybody who dual-boots invites Microsoft to apply their legendary incompetence to their entire system. And so while I understand that dual-booting is (still, sadly) a totally valid need, people who set up their system for dual-boot kind of make life more difficult for themselves. Microsoft is just being Microsoft here.
use totally ancient linux distribution to run virtual machines!
From one of the comments:
Security settings, for them to have any power at all to block malware, have to be default on and unable to be bypassed by the end user (because the end user will bypass them if they get in the way of whatever task/job they have to do right now).
Emphasis mine.
Are people that cucked now that they’re like “yes, please daddy, lock me out of my own machine”?
As an admin… end users are generally fucking stupid with regards to technology. I don’t trust the average individual to operate a spoon.
Then you’ll be hopefully setting a UEFI password for them and end of story. Instead of wanting a corporation to lock out everyone of the machines that they own, making sure that no one on earth can boot unsigned Linux either, for example.
The only charitable read of this is the end-user bypassing controls on company-supplied computers.
Of course that doesn’t mean that they won’t also shove secure boot, hw lockouts, DRM, etc on regular consumer laptops as well.
The security setting is bypassable by the user. It’s just not a “hit enter to install a virus” popup, but the “disable secure boot” toggle in the UEFI firmware settings.
As anyone working in customer support will be able to tell you, if you give people a warning message they can bypass by hitting a button, they’ll smash their face into their keyboard until the unexpected message goes away and blame you for not telling them what they were doing.
The only exception are those weird machines that were built specifically to only run Windows. They’re not compliant with the secure boot standard. Don’t buy those if you don’t want to run Windows, because they’re designed not to. Or hack them, I guess, but that’s a lot of work.
For me there are users, admins and owners, and all levels should have escalating rights to mess with the system. I don’t want a user to have access to security settingsn nor being able to mess with registry or similar stuff. I would prefer a user not being able to do more than read any important part of the HDD too
that’s kind of a violation of the social contract around all of this.
What an interesting journey to the conclusion that it’s not the fucking around with non-Microsoft bootloaders that’s wrong, it’s the installing of bootloaders that aren’t approved by Microsoft. That must be somewhere in the Microsoft social EULA you automatically agreed to when you chose to live in a society.
Somebody please tell me which specific CVEs Debian failed to account for in their many grub security updates.
I have secure boot and tpm disabled on my rig. I’ve been called a fool for this. But I don’t understand how it works, and this is an example.
If I was smart enough to code a new OS or a new boot loader (which I’m not) - how does it become different than a virus? Who approves my code is “safe” to run?
Clearly in this case Microsoft said “those versions of grub are not safe.” So what does that mean? I’m not allowed to run them now because Microsoft decided? That’s all it takes? The whole “what’s safe to run” thing baffles me.
Am I supposed to believe that a govt agency like the nsa could NEVER put malicious backdoors into Microsoft’s products, that Microsoft would NEVER allow that to happen, and that code would NEVER be flagged as safe?
I get it…. It helps with obvious viruses and whatnot. But in my experience, all secure boot has ever done for me is cause problems and lock me out of my computer.
Microsoft, by default, decides which code is safe to run, yes.
However, that’s not the only way to use Secure Boot; I enroll my own certificates in addition to Microsoft’s, allowing code that I sign to be booted into. This requires some UEFI setup once.
For most machines, Secure Boot should never lock you out completely; you can always disable it, fix your boot chain and reenable.
I think it’s actually sensible technology, but as every security feature, it usually comes at the cost of some convenience.
However, that’s not the only way to use Secure Boot; I enroll my own certificates in addition to Microsoft’s, allowing code that I sign to be booted into. This requires some UEFI setup once.
Do you by chance have a guide or documentation you followed to do this that you could link?
Don’t know how much this would help you; I did this on NixOS, however the steps for creating the key pair and enrolling is the same on all distributions, while your UEFI steps can vary depending on the manufacturer.
https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md
https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot for Arch
Update: According to various indications around the net it turns out that the problem (for Debian users at least) is not grub at all, it’s shim itself. They did update the grub SBAT level in a way that should satisfy Microsoft’s demands when they patched the CVE that everyone seems to be pointing to as the one Microsoft was aiming for.
What they didn’t do in time is update shim (possibly related to CVE-2022-28737, I’m not sure.) There is a new version which has the required change but it has not yet made it to Debian stable. Microsoft added an SBAT for shim as well (which gets checked by shim, so if it’s broken… uh… anyway, it’s probably fine) and it’s the one causing the problems.
(Edited to reflect that I don’t really know if it was the fix for CVE-2022-28737 that was needed, the SBAT variable update related to that, or something else. Whichever it is, the shim update currently in the bookworm proposed updates queue should have it.)
lol i dont care, ive stopped dual booting for like a year
SBAT summer