6mo ago

What the fuck is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org mjg59 | What the fuck is an SBAT and why does everyone suddenly care

Follow up to: “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update

SBAT was developed collaboratively between the Linux community and Microsoft, and Microsoft chose to push a Windows update that told systems not to trust versions of grub with a security generation below a certain level. This was because those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain, and we've seen real world examples of malware wanting to do that (Black Lotus did so using a vulnerability in the Windows bootloader, but a vulnerability in grub would be just as viable for this). Viewed purely from a security perspective, this was a legitimate thing to want to do.

...

The problem we've ended up in is that several Linux distributions had not shipped versions of grub with a newer security generation, and so those versions of grub are assumed to be insecure (it's worth noting that grub is signed by individual distributions, not Microsoft, so there's no externally introduced lag here). Microsoft's stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. Unfortunately, as is now obvious, that didn't work as intended and at least some dual-boot setups applied the update and that distribution's Shim refused to boot that distribution's grub.

...

The outcome is that some people can't boot their systems. I think there's plenty of blame here. Microsoft should have done more testing to ensure that dual-boot setups could be identified accurately. But also distributions shipping signed bootloaders should make sure that they're updating those and updating the security generation to match, because otherwise they're shipping a vector that can be used to attack other operating systems and that's kind of a violation of the social contract around all of this.

Linux @programming.dev

Blaze @lemmy.zip

6mo ago

What the fuck is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org /70348.html

32 0

Hacker News @lemmy.smeargle.fans

bot @lemmy.smeargle.fans

BOT

6mo ago

What is an SBAT and why does everyone suddenly care

mjg59.dreamwidth.org /70348.html

5 0

33 comments

It's funny how often Microsoft manages to accidentally do things that just happen to make life more difficult for Linux users. They sure do seem to have bad luck with that.
- They also fuck over their own OS. I don't think they deliberately broke dual boot installs, they simply don't put enough effort in QA. (See their recent problems with BitLocker after an update. Or that one update that fails because some internal partition is too small. And so on.)
- I don't think Microsoft cares that much anymore. The OS wars are over.
  Every Windows now ships with a one-button Linux installer.
  Powershell has default aliases so you can use bash commands for basic stuff.
  Microsoft is one of the top contributors to the Linux kernel.
  They provide documentation on how to install Linux.
  They have published a Linux distro.
  They don't care cause that's not where they make their money. Their focus is on keeping their market dominance in Office, Exchange and AD, or M365, Exchange Online and Entra, respectively (all of which can be accessed from Linux). With those products, they can basically demand a tax of ~$20-30/month/employee from every business in the world.
  
  Let's not forget this is the same company that invented 'Embrace, Extend, Extenguish' as a guiding business model behind closed doors. For me, that trust is broken until proven otherwise.
- In fairness, anybody who dual-boots invites Microsoft to apply their legendary incompetence to their entire system. And so while I understand that dual-booting is (still, sadly) a totally valid need, people who set up their system for dual-boot kind of make life more difficult for themselves. Microsoft is just being Microsoft here.
  
  use totally ancient linux distribution to run virtual machines!

So they claimed it wasn't supposed to affect dual boots, yet it was specifically to patch a vulnerability in GRUB, something a Windows-only user has no reason of ever using (that I'm aware of)?
So how could this have affected anyone but people who dual boot? Sketchy.
- I believe the idea is that even if the machine is running Windows, an attacker could just boot an affected grub version from a USB to perform the exploit
- You, and 62 other people did not read the article.
  
  I don't dual boot so I had no reason to read the article carefully.

From one of the comments:
Security settings, for them to have any power at all to block malware, have to be default on and unable to be bypassed by the end user (because the end user will bypass them if they get in the way of whatever task/job they have to do right now).
Emphasis mine.
Are people that cucked now that they're like "yes, please daddy, lock me out of my own machine"?
- The only charitable read of this is the end-user bypassing controls on company-supplied computers.
  Of course that doesn't mean that they won't also shove secure boot, hw lockouts, DRM, etc on regular consumer laptops as well.
- As an admin... end users are generally fucking stupid with regards to technology. I don't trust the average individual to operate a spoon.
  
  Then you'll be hopefully setting a UEFI password for them and end of story. Instead of wanting a corporation to lock out everyone of the machines that they own, making sure that no one on earth can boot unsigned Linux either, for example.
- You can't trust users to make informed decisions about cybersecurity as most users don't have the necessary background knowledge, so won't think beyond this popup is annoying me and has a button to make it go away and I am smart and therefore immune to malware. Microsoft don't want Windows to have the reputation for being infested with malware like it used to have, and users don't want their bank details stolen. If something's potentially going to be a bad idea, it's better to only give the decision to people capable of making it an informed decision. That's why we don't let children opt into surgery or decide whether to have ice cream for dinner, and have their parents decide instead.
  The comment you're quoting was replying to someone suggesting a warning popup, and saying it would be a bad idea, rather than suggesting the secure boot UEFI option should be taken away. You need at least a little bit more awareness of the problem to know to toggle that setting.
  
  Is that why they introduced "recall?"
- For me there are users, admins and owners, and all levels should have escalating rights to mess with the system. I don't want a user to have access to security settingsn nor being able to mess with registry or similar stuff. I would prefer a user not being able to do more than read any important part of the HDD too
- Yes, they are.

that's kind of a violation of the social contract around all of this.
What an interesting journey to the conclusion that it's not the fucking around with non-Microsoft bootloaders that's wrong, it's the installing of bootloaders that aren't approved by Microsoft. That must be somewhere in the Microsoft social EULA you automatically agreed to when you chose to live in a society.
Somebody please tell me which specific CVEs Debian failed to account for in their many grub security updates.
- It's upstream GRUB that's decided the older GRUB versions are insecure and not to be trusted. Microsoft just propagated that to machines running distros that weren't shipping patched GRUB builds yet. Up-to-date Debian wouldn't be affected provided that they downstreamed fixes quickly.
  https://fedia.io/m/linux@lemmy.ml/t/1111595/-/comment/6916699 says that Debian's GRUB wasn't affected, but another part of the boot sequence was.

Update: According to various indications around the net it turns out that the problem (for Debian users at least) is not grub at all, it's shim itself. They did update the grub SBAT level in a way that should satisfy Microsoft's demands when they patched the CVE that everyone seems to be pointing to as the one Microsoft was aiming for.
What they didn't do in time is update shim (possibly related to CVE-2022-28737, I'm not sure.) There is a new version which has the required change but it has not yet made it to Debian stable. Microsoft added an SBAT for shim as well (which gets checked by shim, so if it's broken... uh... anyway, it's probably fine) and it's the one causing the problems.
(Edited to reflect that I don't really know if it was the fix for CVE-2022-28737 that was needed, the SBAT variable update related to that, or something else. Whichever it is, the shim update currently in the bookworm proposed updates queue should have it.)

I have secure boot and tpm disabled on my rig. I’ve been called a fool for this. But I don’t understand how it works, and this is an example.
If I was smart enough to code a new OS or a new boot loader (which I’m not) - how does it become different than a virus? Who approves my code is “safe” to run?
Clearly in this case Microsoft said “those versions of grub are not safe.” So what does that mean? I’m not allowed to run them now because Microsoft decided? That’s all it takes? The whole “what’s safe to run” thing baffles me.
Am I supposed to believe that a govt agency like the nsa could NEVER put malicious backdoors into Microsoft’s products, that Microsoft would NEVER allow that to happen, and that code would NEVER be flagged as safe?
I get it…. It helps with obvious viruses and whatnot. But in my experience, all secure boot has ever done for me is cause problems and lock me out of my computer.
- Microsoft, by default, decides which code is safe to run, yes.
  However, that's not the only way to use Secure Boot; I enroll my own certificates in addition to Microsoft's, allowing code that I sign to be booted into. This requires some UEFI setup once.
  For most machines, Secure Boot should never lock you out completely; you can always disable it, fix your boot chain and reenable.
  I think it's actually sensible technology, but as every security feature, it usually comes at the cost of some convenience.
  
  However, that’s not the only way to use Secure Boot; I enroll my own certificates in addition to Microsoft’s, allowing code that I sign to be booted into. This requires some UEFI setup once.
  Do you by chance have a guide or documentation you followed to do this that you could link?
  
  What is secure boot even going to protect the average user against though? Is there really any chance of a normal user trying to boot something malicious?

SBAT summer

lol i dont care, ive stopped dual booting for like a year

33 comments