I think this secure boot thingy is about IT department setting up
associate's
computers for high security. I don't think home users will see any
benefits...
Home users will be somewhat protected against what are
referred to as "Boot Sector Malware". Depending on how deeply the code signing
is taken into the OS, it might even protect against some of the current rootkit
malware that's in the wild today. Much of this protection is already present in
various BIOS flavors, under the name of "MBR protection" or "OS Install
Mode"
But it will not take long for the malware writers to adapt to this,
just like they've adapted to the current protections. Perhaps they'll just add
a "You have to add this certificate to your UEFI trusted store before you can
see this hillarious cat video" clickbox to their malware, and *poof* there goes
the protection.
Very few IT shops have enough clout over the individual
(associate's) computers to enforce application whitelisting (which is basically
what this is at the boot layer), and even if they did, supporting only a single
signature in the UEFI software makes it completely useless for this purpose. An
IT department wouldn't be able to sign "approved" OSs, they would have to trust
all MS products. And MS-signature isn't necessarily proof of goodness-- look at
the Flame/SkyWiper malware that used a (forged) Microsoft certificate.
--Joe [ Reply to This | Parent | # ]
|