Disabling Secure Boot signature validation

[mjg59]

One of the benefits of the Shim approach of bridging trust between the Microsoft key and our own keys is that we can define whatever trust policy we want. Some of the feedback we've received has indicated that people really do want the ability to disable signature validation without having to go through the firmware. The problem is in ensuring that this can't be done either accidentally or via trivial social engineering.

We've come up with one possible solution for this. A tool run at the OS level generates a random password and hashes it. This hash is appended to the desired secure boot state and stored in an EFI variable. On reboot, Shim notices that this variable is set and drops to a menu. The user then selects "Change signature enforcement" and types the same password again. The system is then rebooted and Shim now skips the signature validation.

This approach avoids automated attacks - if malware sets this variable, the user will have no idea which password is required. Any social engineering attack would involve a roughly equivalent number of steps to disabling Secure Boot in the firmware UI, so it's not really any more attractive than just doing that. We're fairly confident that this meets everyone's expectations of security, but also guarantees that people who want to run arbitrary kernels and bootloaders can do so.

Comments

[simont]

Is this not the sort of policy liable to cause whatever upstream authority is signing Shim itself to decide it isn't the sort of thing they're comfortable certifying as safe?

(Or is it simply a laughable idea that a signature on a bootloader certifies anything other than that somebody with halfway plausible credentials gave a lot of money to the signing authority?)

[mjg59]

The model is that Microsoft will sign pretty much anything (within reason) but will revoke signatures if (and only if) the binary is actually used to attack systems. It's up to the vendor of the bootloader what kind of security policy they want to construct and what risks they're willing to take in order to ensure that their bootloader isn't used that way.

Anonymity

[(Anonymous)]

One thing malware authors badly need and work really hard to achieve is anonymity.

"Hi Microsoft! Sell me a Secure Boot certificate but please also make sure you will never be able to find me again."

Impossible? No. Very difficult? Yes, likely to be. Less malware (in numbers) is more security.