Hacker News Reader

Comment by ge0rg | Hacker News Reader

TL;DR: Microsoft's Secure Boot bootloader is vulnerable to an attack where you use a (Microsoft-signed) supplemental boot policy instead of a regular boot policy, effectively removing the Secure Boot lock and allowing to run unsigned code.

This affects locked devices (Windows RT, Phone, ...) and might be used for jailbreaking devices as well as to attack their security.

View on HN

> can be used for jailbreaking devices as well as to attack their security.

This sounds quite negative. Another (very postive) consequence is to install unsigned OS'es (read: Linux).

I tried to remain as neutral as possible with the summary. My personal opinion is that it should be possible for the owner of a device to install any OS they wish, and do so without compromising the device security.

Unfortunately, we are very far away from that goal. Either there is no (official) way to unlock the bootloader, or we get a full unlock where everybody with physical access to the device can install whatever rootkit they wish.

>Unfortunately, we are very far away from that goal.

Not at all. It's commonplace in UEFI motherboards. You can supply your own keys and then sign your kernel/bootloader.

Microsoft just decided the owners of these devices should not be allowed to control their device's boot process.

I think that's why the "jailbreak" wording I've seen used is fairly appropriate. The flip side to the risks that result from trusting some sort of locked bootloader for security also mean that you can gain more control over your gear.

On one hand, I think that aspect is wonderful news but on the other hand, there are already a lot of options for devices with unlocked (or unlockable) bootloaders and some orgs may have specifically desired the locked option as part of their security setup and this undermines that.

The only thing that is relevant regardless is how it illustrates the flaws in any system that relies on secret master keys/backdoors

[edit] I was uninformed, there is no delete option.

Surface Pro / Surface Book can disable secure boot without hacks, this only applies to Surface RT (i.e. the ARM one)

Won't you need another exploit to do this on RT/Phone? It's not like they allow you to write to arbitrary files by default...

On Phone, the exploit chain to do exactly that is already public.

on RT, you don't need another exploit at all :) It allows you to run the command prompt as admin by default

forgive my limited knowledge in this, but I have an RT and wondering what I can do with it. What can I do with it and how? Any links/resources? thanks

EDIT: saw your other comments :) I'm still up for more info if you have any regarding installing new apps or OS on RT

Reply on news.ycombinator.com