Follow up to: “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
SBAT was developed collaboratively between the Linux community and Microsoft, and Microsoft chose to push a Windows update that told systems not to trust versions of grub with a security generation below a certain level. This was because those versions of grub had genuine security vulnerabilities that would allow an attacker to compromise the Windows secure boot chain, and we’ve seen real world examples of malware wanting to do that (Black Lotus did so using a vulnerability in the Windows bootloader, but a vulnerability in grub would be just as viable for this). Viewed purely from a security perspective, this was a legitimate thing to want to do.
…
The problem we’ve ended up in is that several Linux distributions had not shipped versions of grub with a newer security generation, and so those versions of grub are assumed to be insecure (it’s worth noting that grub is signed by individual distributions, not Microsoft, so there’s no externally introduced lag here). Microsoft’s stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself. Unfortunately, as is now obvious, that didn’t work as intended and at least some dual-boot setups applied the update and that distribution’s Shim refused to boot that distribution’s grub.
…
The outcome is that some people can’t boot their systems. I think there’s plenty of blame here. Microsoft should have done more testing to ensure that dual-boot setups could be identified accurately. But also distributions shipping signed bootloaders should make sure that they’re updating those and updating the security generation to match, because otherwise they’re shipping a vector that can be used to attack other operating systems and that’s kind of a violation of the social contract around all of this.
It’s to protect the user against malware that would insert itself in the boot chain and run at higher privilege than the kernel. Just booting a malicious ISO can insert malware in the boot chain without your knowledge. Once you’re in the boot chain, you boot before the kernel, so you can inject whatever drivers you want.
That’s particularly important on corporate computers where they don’t want users to bypass IT policies, but also important for the average Windows user that won’t stop loading malware on their computers. Without secure boot there’s nothing stopping you from forcing yourself local admin privileges or even silently exfiltrate data.
That’s been a thing forever: DOS boot sector malware for example. By only booting signed bootloaders and kernels, you can ensure this doesn’t happen.
I have a friend that abused an insufficiently locked down GRUB to root his workstation at work by using the
init=/bin/shtrick to patch a SUID binary to make his own sudo.But what average user is booting anything other than their hard disk ever in the past like decade? It just seems like an odd attack vector to put so much effort into stopping on consumer devices, it makes sense for businesses though