it's a very dangerous attack vector.
EDIT: writing from a Lenovo laptop where Linux it's the sole OS installed.
Allowing Linux to boot was a hundred times simpler than allowing DOOM to run on my 486 with 4MB of RAM.
And you need that for recovery purposes, at least.
The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?).
Not trusting external and/or removable storage as a valid bootable source is a sensible default.
p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.
The ubuntu usb key you are booting is safer than what you already got installed...
Still not perfect, but way better than without.
But worst of all: Superfish was actually _signed_ itself. MS has improved the level of vetting they do now, specially for kernel drivers, but how come anyone can still claim with a serious face that a signature requirement from one CA specifically improves security against malware _from that CA_ (or their associates) ?
I didn't say it was, you kinda ignored the context. The person who I replied to was asking how can they trust their Windows is genuine, I replied to them that the feature causing a stir here does protect against some types of malware.
It's a fair assumption that the next thing akin to Superfish would try to implant itself deeper, if given the chance, Device Guard does eliminate some of those ways.
> for preinstalled software such as drivers
If that driver is actually malicious then Early-Launch Antimalware alongside the kernel being protected, can get rid of it.
> There would be absolutely no difference on whether you used Secure Boot or not.
I wasn't talking exclusively about Secure Boot.
> But worst of all: Superfish was actually _signed_ itself.
Sure, now there's a toggle that won't trust some signatures that aren't as heavily vetted (amongst many other things). How is that "ridiculous" or "won't make a difference". Are you just looking for a reason to argue?
> [Device Guard] does prevent quite a few different malware preinstallation methods. Including the infamous Lenovo one.
Which is the infamous Lenovo malware "preinstallation method" ?
How would a signature system would have prevented malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image shipped with Lenovo hardware ?
Yes, and I didn't call it a "kernel rootkit" as you said I did.
> How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ?
Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.
Lenovo does that for you
They are legally responsible.
> The ubuntu usb key you are booting is safer than what you already got installed...
Have you read my post?
I use Linux, I'm writing from Debian, on a Lenovo laptop.
It took 10 seconds to allow Linux to boot.
On this specific Z13? Or other model, which wasn't "improved" yet?
10 seconds at most.
no need for being sarcastic.
I do want to use secure boot and TPM2 (I do, currently). Just not with windows. Why should be secure boot windows exclusive feature? Until now, it wasn't.
There was no sarcasm.
it's a solution
it's only a matter of choice, there's no wrong choice, choices are personal.
You're complaining about something that's very easy to overcome.
> I do want to use secure boot and TPM2 (I do, currently). Just not with windows
You can.
just disable device guard.
> Why should be secure boot windows exclusive feature?
you are angry about the wrong thing
device guard and secure boot are different things, related, but different.
> device guard and secure boot are different things, related, but different.
The problem is that it can have potentially catastrophic impact. If the user enabled Bitlocker, and didn't save recovery key (it will happen for mainstream users), he can lose his windows drive when he tries linux.
As I wrote above, another extra-hop for those who would like to go off the beaten windows path.
it's a configuration option.
it's a bad workaround for you.
I disagree.
> If the user enabled Bitlocker, and didn't save recovery key
then the user is responsible of being incautious.
case closed.
Congratulation, you just invalidated the entire raison d'etre of both Secure Boot and this new Device Guard.
The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
Not on my computers for the past 20 years.
If the default is not bootable a “no bootable device found” message appears.
computers should never automatically boot from external storage, unless the user wants to.
- try to boot the internal devices
- then try external (some even distinguish optical and key fobs)
- then try PXE
and only when all of these fail, message the user "no bootable device found".
And even then this message appeared
Press any key to boot from CD...
because computers should never automatically boot from external or removable storage
that's why a more modern version of the same message exists
It won't boot from USB if the internal drive boots, or unless I manually change boot order.
Having said all that, this comment is all anecdotal, much like yours.
If people in corporate environments want to disable this, they can set a BIOS password to keep others out of the boot menu.