Practical security for 2014 [LWN.net]

Practical security for 2014

Posted Jan 12, 2014 2:07 UTC (Sun) by Cyberax (✭ supporter ✭, #52523)
In reply to: Practical security for 2014 by dashesy
Parent article: Practical security for 2014

Right now this kind of malware doesn't even need to exploit anything.

to post comments

Practical security for 2014

Posted Jan 12, 2014 2:29 UTC (Sun) by dashesy (guest, #74652) [Link] (3 responses)

No, but can be detected and removed much easier.

Practical security for 2014

Posted Jan 12, 2014 3:02 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

How? Short of booting from an external media a perfect rootkit would be undetectable.

Practical security for 2014

Posted Jan 12, 2014 4:05 UTC (Sun) by dashesy (guest, #74652) [Link] (1 responses)

Easier, not easy.
While auditing a dis-assembly of a ROM in old BIOS is something an over-suspicious (or critically targeted) agency may endeavor, same task with all the complexity of secure boot is doubly crazy. Also if one could get suspicious of rootkit activity (battery consumption, CPU noise, suspicious network access, ...) in non-secure boot, same activity could be just attributed to the complexity of SecureBoot and ignored, assuming that all is safe because OS booted fine, and so the chain must be secure. The false sense of security.
From practical point of view, if it is harder for OS (and BIOS vendors) to get it right (look at all the problems resulting in non-working systems), then it will be just as hard to validate every once in a while by an audit.

Practical security for 2014

Posted Jan 12, 2014 16:10 UTC (Sun) by raven667 (subscriber, #5198) [Link]

> Also if one could get suspicious of rootkit activity (battery consumption, CPU noise, suspicious network access, ...) in non-secure boot, same activity could be just attributed to the complexity of SecureBoot and ignored, assuming that all is safe because OS booted fine, and so the chain must be secure.

I'm sorry but that's total baloney, I don't think anyone but you would try to attribute suspicious network activity, high battery consumption and high CPU usage to the bootloader code having a signature validated before it was run when the system booted.