Hacker News Reader

Comment by spydum | Hacker News Reader

How strange, shouldn't windows be checking if the binary is signed? Isn't that part of what secureboot and deviceguard do? Or does it just run like any addon?

View on HN

Secure Boot only verifies the NT kernel loader; that in turn will verify that the kernel is signed by Microsoft, and then the kernel will verify any device drivers it loads. Userland (e.g. explorer.exe) is free to be run without any signatures whatsoever; this includes the login screen.

its a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot

We don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater.

Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1]

Alternatively, patch routines directly in memory [2]

[1] https://www.kali.org/tools/chntpw/

[2] https://www.piotrbania.com/all/kon-boot/

> We don't expect Linux to do this, do we?

Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).

All androids do it as well

No, only Android from version 4.4 supports Verified Boot, and only Android from version 7.0 strictly enforces it.

Still possible, as presented at BlueHat IL 2023, the goal is to eventually have everything signed, based on how UWP sandboxing is working, now extended to Win32 as well.

First set of changes already in flight for the next Windows 11 stable release.

Windows Defender started checking for modifications to binaries like utilman.exe or sethc.exe a couple of years ago.

secureboot could be leveraged for such things but as with most great features, only the bare minimum implementation is provided in 'modern secure operating systems'

Reply on news.ycombinator.com