Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

C is quirky, flawed, and an enormous success -- Dennis M. Ritchie

computers / comp.os.linux.misc / uefi malware--threat to all?

SubjectAuthor
* uefi malware--threat to all?pH
+- Re: uefi malware--threat to all?Richard Kettlewell
+* Re: uefi malware--threat to all?Marco Moock
|`* Re: uefi malware--threat to all?pH
| +- Re: uefi malware--threat to all?28B.I874
| +* Re: uefi malware--threat to all?Bobbie Sellers
| |+- Re: uefi malware--threat to all?28B.I874
| |+* Re: uefi malware--threat to all?Marco Moock
| ||`* Re: uefi malware--threat to all?Bobbie Sellers
| || +- Re: uefi malware--threat to all?The Natural Philosopher
| || `* Re: uefi malware--threat to all?Marco Moock
| ||  `* Re: uefi malware--threat to all?Bobbie Sellers
| ||   `* Re: uefi malware--threat to all?28B.A864
| ||    `* Re: uefi malware--threat to all?The Natural Philosopher
| ||     `* Re: uefi malware--threat to all?TJ
| ||      +* Re: uefi malware--threat to all?Marco Moock
| ||      |+* Re: uefi malware--threat to all?Robert Heller
| ||      ||+* Re: uefi malware--threat to all?29V.X746
| ||      |||`* Re: uefi malware--threat to all?Carlos E.R.
| ||      ||| `* Re: uefi malware--threat to all?The Natural Philosopher
| ||      |||  +- Re: uefi malware--threat to all?Dan Espen
| ||      |||  +* Re: uefi malware--threat to all?Carlos E.R.
| ||      |||  |+- Re: uefi malware--threat to all?29V.X746
| ||      |||  |`- Re: uefi malware--threat to all?The Natural Philosopher
| ||      |||  +- Re: uefi malware--threat to all?29V.X746
| ||      |||  `* Re: uefi malware--threat to all?Robert Riches
| ||      |||   +* Re: uefi malware--threat to all?29V.X746
| ||      |||   |+- Re: uefi malware--threat to all?Carlos E.R.
| ||      |||   |+* Re: uefi malware--threat to all?Bobbie Sellers
| ||      |||   ||`- Re: uefi malware--threat to all?29V.X746
| ||      |||   |`- Re: uefi malware--threat to all?Robert Riches
| ||      |||   `* Re: uefi malware--threat to all?The Natural Philosopher
| ||      |||    `- Re: uefi malware--threat to all?29V.X746
| ||      ||+- Re: uefi malware--threat to all?The Natural Philosopher
| ||      ||`- Re: uefi malware--threat to all?TJ
| ||      |+- Re: uefi malware--threat to all?The Natural Philosopher
| ||      |`- Re: uefi malware--threat to all?TJ
| ||      +* Re: uefi malware--threat to all?Carlos E.R.
| ||      |`* Re: uefi malware--threat to all?TJ
| ||      | `- Re: uefi malware--threat to all?Carlos E.R.
| ||      +- Re: uefi malware--threat to all?The Natural Philosopher
| ||      `* Re: uefi malware--threat to all?Roger Blake
| ||       +* Re: uefi malware--threat to all?29V.X746
| ||       |+* Re: uefi malware--threat to all?Richard Kettlewell
| ||       ||`- Re: uefi malware--threat to all?Carlos E.R.
| ||       |+- Re: uefi malware--threat to all?Carlos E.R.
| ||       |`* Re: uefi malware--threat to all?TJ
| ||       | `* Re: uefi malware--threat to all?Robert Heller
| ||       |  `* Re: uefi malware--threat to all?TJ
| ||       |   `* Re: uefi malware--threat to all?Robert Heller
| ||       |    `* Re: uefi malware--threat to all?Fritz Wuehler
| ||       |     `* Re: uefi malware--threat to all?jeshgrca
| ||       |      `* Re: uefi malware--threat to all?Fritz Wuehler
| ||       |       `* Re: uefi malware--threat to all?27E.G756
| ||       |        `* Re: uefi malware--threat to all?Carlos E.R.
| ||       |         +* Re: uefi malware--threat to all?27E.G756
| ||       |         |`* Re: uefi malware--threat to all?Carlos E.R.
| ||       |         | `- Re: uefi malware--threat to all?27E.G756
| ||       |         `* Re: uefi malware--threat to all?Charlie Gibbs
| ||       |          `- Re: uefi malware--threat to all?27E.G756
| ||       +- Re: uefi malware--threat to all?Marco Moock
| ||       +* Re: uefi malware--threat to all?TJ
| ||       |`* Re: uefi malware--threat to all?Carlos E.R.
| ||       | `* Re: uefi malware--threat to all?Charlie Gibbs
| ||       |  `* Re: uefi malware--threat to all?Carlos E.R.
| ||       |   `* Re: uefi malware--threat to all?27E.G756
| ||       |    `* Re: uefi malware--threat to all?Carlos E.R.
| ||       |     `* Re: uefi malware--threat to all?27E.G756
| ||       |      `* Re: uefi malware--threat to all?Computer Nerd Kev
| ||       |       `- Re: uefi malware--threat to all?22T.R732
| ||       `- Re: uefi malware--threat to all?TJ
| |`* Re: uefi malware--threat to all?Carlos E.R.
| | +* Re: uefi malware--threat to all?David W. Hodgins
| | |`* Re: uefi malware--threat to all?Marco Moock
| | | `- Re: uefi malware--threat to all?David W. Hodgins
| | `* Re: uefi malware--threat to all?Marco Moock
| |  `* Re: uefi malware--threat to all?28B.I874
| |   +* Re: uefi malware--threat to all?David W. Hodgins
| |   |`* Re: uefi malware--threat to all?28B.I874
| |   | `* Re: uefi malware--threat to all?David W. Hodgins
| |   |  `- Re: uefi malware--threat to all?28C.I874
| |   +* Re: uefi malware--threat to all?The Natural Philosopher
| |   |`* Re: uefi malware--threat to all?Richard Kettlewell
| |   | `* Re: uefi malware--threat to all?The Natural Philosopher
| |   |  `* Re: uefi malware--threat to all?Richard Kettlewell
| |   |   +- Re: uefi malware--threat to all?Robert Heller
| |   |   +- Re: uefi malware--threat to all?Rich
| |   |   +- Re: uefi malware--threat to all?The Natural Philosopher
| |   |   `* Re: uefi malware--threat to all?The Natural Philosopher
| |   |    `* Re: uefi malware--threat to all?Carlos E.R.
| |   |     `- Re: uefi malware--threat to all?Robert Heller
| |   `- Re: uefi malware--threat to all?Marco Moock
| `- Re: uefi malware--threat to all?Marco Moock
`* Re: uefi malware--threat to all?Andrei Z.
 `* Re: uefi malware--threat to all?pH
  +* Re: uefi malware--threat to all?David W. Hodgins
  |`- Re: uefi malware--threat to all?Marco Moock
  +- Re: uefi malware--threat to all?The Natural Philosopher
  `* Re: uefi malware--threat to all?Bobbie Sellers
   `* Re: uefi malware--threat to all?Carlos E.R.
    +- Re: uefi malware--threat to all?The Natural Philosopher
    `* Re: uefi malware--threat to all?Marco Moock

Pages:12345
uefi malware--threat to all?

<tu5afp$qf3$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11902&group=comp.os.linux.misc#11902

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: wNOSPAMp@gmail.org (pH)
Newsgroups: comp.os.linux.misc
Subject: uefi malware--threat to all?
Date: Mon, 6 Mar 2023 18:13:14 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 13
Message-ID: <tu5afp$qf3$1@dont-email.me>
Injection-Date: Mon, 6 Mar 2023 18:13:14 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="1c5de37694bd6e24af8eef30cfa0ea1a";
logging-data="27107"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/tZMnnE0X80pxgMazIeGAkRTejiOY0tQ8="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:vmDFHezuCTk/wfC1SipzddA2t+k=
 by: pH - Mon, 6 Mar 2023 18:13 UTC

I just saw this article in google news today.

https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/

I'm not up on my acronyms, but I've seen uefi mentioned here at times.

I'm assuming since this runs first, Linux is therefore not immune to this
malware.

Would a workaround be enabling legacy boot and running an older distro
until...well, I'll wait for any comments from you smarter guys out there.

pH in Aptos

Re: uefi malware--threat to all?

<wwv1qm17kun.fsf@LkoBDZeT.terraraq.uk>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11903&group=comp.os.linux.misc#11903

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.nntp4.net!nntp.terraraq.uk!.POSTED.tunnel.sfere.anjou.terraraq.org.uk!not-for-mail
From: invalid@invalid.invalid (Richard Kettlewell)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Mon, 06 Mar 2023 19:14:56 +0000
Organization: terraraq NNTP server
Message-ID: <wwv1qm17kun.fsf@LkoBDZeT.terraraq.uk>
References: <tu5afp$qf3$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: innmantic.terraraq.uk; posting-host="tunnel.sfere.anjou.terraraq.org.uk:172.17.207.6";
logging-data="17356"; mail-complaints-to="usenet@innmantic.terraraq.uk"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
Cancel-Lock: sha1:ycnHtT8k8rbgx19bLTvkjRRySOk=
X-Face: h[Hh-7npe<<b4/eW[]sat,I3O`t8A`(ej.H!F4\8|;ih)`7{@:A~/j1}gTt4e7-n*F?.Rl^
F<\{jehn7.KrO{!7=:(@J~]<.[{>v9!1<qZY,{EJxg6?Er4Y7Ng2\Ft>Z&W?r\c.!4DXH5PWpga"ha
+r0NzP?vnz:e/knOY)PI-
X-Boydie: NO
 by: Richard Kettlewell - Mon, 6 Mar 2023 19:14 UTC

pH <wNOSPAMp@gmail.org> writes:
> I just saw this article in google news today.
>
> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>
> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>
> I'm assuming since this runs first, Linux is therefore not immune to this
> malware.

Yes and no. Once the bootkit is installed, any OS on that computer is
vulnerable. But installing the bootkit in the first place depends on a
vulnerability in one of the Windows boot components. So I think a system
that had never had Windows installed on it should not be at risk (at
least, until someone finds a comparable bug in Linux’s UEFI boot chain).

> Would a workaround be enabling legacy boot and running an older distro
> until...well, I'll wait for any comments from you smarter guys out
> there.

That would be like addressing a weak lock by taking the whole door off,
since legacy boot does not include secure boot.

--
https://www.greenend.org.uk/rjk/

Re: uefi malware--threat to all?

<tu5h5u$j3i$3@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11904&group=comp.os.linux.misc#11904

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Mon, 6 Mar 2023 21:07:26 +0100
Organization: A noiseless patient Spider
Lines: 20
Message-ID: <tu5h5u$j3i$3@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 6 Mar 2023 20:07:26 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="1bfe3ccc98391d4c78dab99427b49a8f";
logging-data="19570"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19x7dFPYwjclq6KGBQKiz4A"
Cancel-Lock: sha1:7Xrv2vfIa/Qtq8v/R30CYfXZUAs=
 by: Marco Moock - Mon, 6 Mar 2023 20:07 UTC

Am 06.03.2023 um 18:13:14 Uhr schrieb pH:

> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>
> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>
> I'm assuming since this runs first, Linux is therefore not immune to
> this malware.
>
> Would a workaround be enabling legacy boot and running an older distro
> until...well, I'll wait for any comments from you smarter guys out
> there.

No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
used) doesn't contain SecureBoot at all. If a software can change the
boot loader, it can infect every system.

Also attacks on the firmware directly are still possible, just like a
normal BIOS/UEFI firmware update.

Re: uefi malware--threat to all?

<tu60tv$49m8$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11906&group=comp.os.linux.misc#11906

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: wNOSPAMp@gmail.org (pH)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 00:36:15 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 30
Message-ID: <tu60tv$49m8$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
Injection-Date: Tue, 7 Mar 2023 00:36:15 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="384fee31552595185e2f0f8c450ba8e0";
logging-data="141000"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+uw+E2yqS7Vxj/S+4dSr6J4fdvEuDTSE8="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:SgVSmVsnFu5plw76nFb4t+c3uYE=
 by: pH - Tue, 7 Mar 2023 00:36 UTC

On 2023-03-06, Marco Moock <mo01@posteo.de> wrote:
> Am 06.03.2023 um 18:13:14 Uhr schrieb pH:
>
>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>
>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>
>> I'm assuming since this runs first, Linux is therefore not immune to
>> this malware.
>>
>> Would a workaround be enabling legacy boot and running an older distro
>> until...well, I'll wait for any comments from you smarter guys out
>> there.
>
> No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
> used) doesn't contain SecureBoot at all. If a software can change the
> boot loader, it can infect every system.
>
> Also attacks on the firmware directly are still possible, just like a
> normal BIOS/UEFI firmware update.
>

OKay, thanks for the comments.

I'm gathering that secure boot is actually a *good* thing and not just some
microsoft introduction.

Since I install so seldom I'm really not up on these things.

pH

Re: uefi malware--threat to all?

<agSdncoMfelsE5v5nZ2dnZfqnPSdnZ2d@earthlink.com>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11907&group=comp.os.linux.misc#11907

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!feed1.usenet.blueworldhosting.com!peer03.iad!feed-me.highwinds-media.com!news.highwinds-media.com!Xl.tags.giganews.com!local-1.nntp.ord.giganews.com!nntp.earthlink.com!news.earthlink.com.POSTED!not-for-mail
NNTP-Posting-Date: Tue, 07 Mar 2023 01:10:09 +0000
Subject: Re: uefi malware--threat to all?
Newsgroups: comp.os.linux.misc
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
From: 28B.I874@noabzba.net (28B.I874)
Organization: gear transect
Date: Mon, 6 Mar 2023 20:10:08 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <tu60tv$49m8$1@dont-email.me>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Message-ID: <agSdncoMfelsE5v5nZ2dnZfqnPSdnZ2d@earthlink.com>
Lines: 39
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 68.222.41.46
X-Trace: sv3-t3VTqO47j3F8jrGWvkCDdWeEqfz30hoTJUYK9bdcA4VTFwvabS1GgrwQ3jxGA7iFCU61Nkb1kUCcnzx!Q1EzEMQJbYPR5jqqsHXmLkwDEIK2Bi3i1LTh7iIkYQusxEKZq1PEBLmZTlN8LER8d+IpVQZ6rtws!wn5PMS7vgq5XVInys/I=
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Received-Bytes: 2756
 by: 28B.I874 - Tue, 7 Mar 2023 01:10 UTC

On 3/6/23 7:36 PM, pH wrote:
> On 2023-03-06, Marco Moock <mo01@posteo.de> wrote:
>> Am 06.03.2023 um 18:13:14 Uhr schrieb pH:
>>
>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>
>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>
>>> I'm assuming since this runs first, Linux is therefore not immune to
>>> this malware.
>>>
>>> Would a workaround be enabling legacy boot and running an older distro
>>> until...well, I'll wait for any comments from you smarter guys out
>>> there.
>>
>> No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
>> used) doesn't contain SecureBoot at all. If a software can change the
>> boot loader, it can infect every system.
>>
>> Also attacks on the firmware directly are still possible, just like a
>> normal BIOS/UEFI firmware update.
>>
>
> OKay, thanks for the comments.
>
> I'm gathering that secure boot is actually a *good* thing and not just some
> microsoft introduction.
>
> Since I install so seldom I'm really not up on these things.

The message is that THERE'S NO PERFECT THING.
So DO check for viruses periodically and there's
software that can find Linux rootkits too.

Ok, maybe an immutable un-updatable BIOS-ish
booty thingie ...... (for some embedded uses
that'd be just fine. You don't need a BIOS
to make a, say, Arduino run) .....

Re: uefi malware--threat to all?

<tu630a$4hb3$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11908&group=comp.os.linux.misc#11908

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: bliss@mouse-potato.com (Bobbie Sellers)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Mon, 6 Mar 2023 17:11:38 -0800
Organization: dis-organization
Lines: 62
Message-ID: <tu630a$4hb3$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 7 Mar 2023 01:11:38 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="5b72655cb687845539958fb52433276f";
logging-data="148835"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18NNPLZJbE8OF9V8dkV+tiV"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Cancel-Lock: sha1:uPLZUwsf2UpSqgzt+ggdNDgbTnE=
In-Reply-To: <tu60tv$49m8$1@dont-email.me>
Content-Language: en-US
 by: Bobbie Sellers - Tue, 7 Mar 2023 01:11 UTC

On 3/6/23 16:36, pH wrote:
> On 2023-03-06, Marco Moock <mo01@posteo.de> wrote:
>> Am 06.03.2023 um 18:13:14 Uhr schrieb pH:
>>
>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>
>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>
>>> I'm assuming since this runs first, Linux is therefore not immune to
>>> this malware.
>>>
>>> Would a workaround be enabling legacy boot and running an older distro
>>> until...well, I'll wait for any comments from you smarter guys out
>>> there.
>>
>> No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
>> used) doesn't contain SecureBoot at all. If a software can change the
>> boot loader, it can infect every system.
>>
>> Also attacks on the firmware directly are still possible, just like a
>> normal BIOS/UEFI firmware update.
>>
>
> OKay, thanks for the comments.
>
> I'm gathering that secure boot is actually a *good* thing and not just some
> microsoft introduction.
>
> Since I install so seldom I'm really not up on these things.
>
> pH
Secure Boot is not a good thing but a Microsoft attempt to satisfy it's
corporate customers and to lock out the possibility of
using Linux on a Windows machine. There are further attempts to
foreclose the possibility of using a secure OS on machines installed
with Windows. In corporate circumstances it locks down the systems
against unauthorized intrusions by any but the assigned IP technicians.
Just to point out than many corporate users will learn enough to turn
it off but it does provide a little security.

When installing Linux to a machine with the Secure Boot enabled
most of us disable it. Some few Linux systems have paid the toll to
Microsoft and gotten a key which will satisfy the Secure Boot system.
When using Windows and any Linux system on the same hardware you must
be aware that Windows without warnings sends new kernels to the system
and when that happens the previous boot setting are over-written messing
up the Linux boot as well. You will need a Live Linux Distribution to
fix the broken boot syste.
Those Linux systems paying the toll are trying for the same market as
MS. They are called Enterprise systems; like Red Hat,
Canonical(Ubuntu), and a few others. They are trying for the corporate
market and Government markets. I hope they displace Windows.
bliss - on the ever-faithful Dell Latitude E7450, PCLinuxOS 2022
KDE Plasma 5.27.2 Kernel Version: 6.1.15-pclos1 (64-bit)
KDE Frameworks 5.103.0 - Qt Version: 5.15.6
Graphics : X11 - Mesa Intel® HD Graphics 5500
15.5 GiB of RAM CPU 4 × Intel® Core™ i7-5600U CPU @ 2.60GHz
Actually 2 real cores and 2 virtual cores.
--
bliss dash SF 4 ever at dslextreme dot com

Re: uefi malware--threat to all?

<qgqdna88__U2Upv5nZ2dnZfqnPqdnZ2d@earthlink.com>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11911&group=comp.os.linux.misc#11911

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!feed1.usenet.blueworldhosting.com!peer02.iad!feed-me.highwinds-media.com!news.highwinds-media.com!border-1.nntp.ord.giganews.com!nntp.giganews.com!Xl.tags.giganews.com!local-2.nntp.ord.giganews.com!nntp.earthlink.com!news.earthlink.com.POSTED!not-for-mail
NNTP-Posting-Date: Tue, 07 Mar 2023 05:46:19 +0000
Subject: Re: uefi malware--threat to all?
Newsgroups: comp.os.linux.misc
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
From: 28B.I874@noabzba.net (28B.I874)
Organization: gear transect
Date: Tue, 7 Mar 2023 00:46:18 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <tu630a$4hb3$1@dont-email.me>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Message-ID: <qgqdna88__U2Upv5nZ2dnZfqnPqdnZ2d@earthlink.com>
Lines: 64
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 68.222.41.46
X-Trace: sv3-aqlqJq9AuX2CNHqjkTkrwBbIHnthn+shxFQpGPUV0FbyoPI0ws6342WNG/r1wcatuxXcKLDep00Y+tw!4V1CiWp8DJOTZfuvAkJKOJrnmhFEE5v2I3XhW9aFJkZrHRwjxkvgh1x41V4a+ejEK0R7H1lHiLyg!/3lYvNGQFCYYX6w3IsQ=
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Received-Bytes: 4060
 by: 28B.I874 - Tue, 7 Mar 2023 05:46 UTC

On 3/6/23 8:11 PM, Bobbie Sellers wrote:
> On 3/6/23 16:36, pH wrote:
>> On 2023-03-06, Marco Moock <mo01@posteo.de> wrote:
>>> Am 06.03.2023 um 18:13:14 Uhr schrieb pH:
>>>
>>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>>
>>>>
>>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>>
>>>> I'm assuming since this runs first, Linux is therefore not immune to
>>>> this malware.
>>>>
>>>> Would a workaround be enabling legacy boot and running an older distro
>>>> until...well, I'll wait for any comments from you smarter guys out
>>>> there.
>>>
>>> No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
>>> used) doesn't contain SecureBoot at all. If a software can change the
>>> boot loader, it can infect every system.
>>>
>>> Also attacks on the firmware directly are still possible, just like a
>>> normal BIOS/UEFI firmware update.
>>>
>>
>> OKay, thanks for the comments.
>>
>> I'm gathering that secure boot is actually a *good* thing and not just
>> some
>> microsoft introduction.
>>
>> Since I install so seldom I'm really not up on these things.
>>
>> pH
>     Secure Boot is not a good thing but a Microsoft attempt to satisfy
> it's corporate customers and to lock out the possibility of
> using Linux on a Windows machine.  There are further attempts to
> foreclose the possibility of using a secure OS on machines installed
> with Windows.  In corporate circumstances it locks down the systems
> against unauthorized intrusions by any but the assigned IP technicians.
> Just to point out than many corporate users will learn enough to turn
> it off but it does provide a little security.

JUST a little ... and then mostly just for Winders.

M$ is always picking around the edges to try and shut
out any alternatives. They can't be TOO overt, but they
keep at it. They have enough clout to make motherboard/
BIOS-makers tweak their products to HELP them in this
endeavour. It'll always be framed as a 'security
enhancement' of some kind - because it makes the M$
profits more secure.

I see people making excuses for them - but really they
are just another evil megacorporate empire at this point.

So, what to do ? Well, perhaps pay for maybe a S.Korean
motherboard factory that can turn out a decent functional
clone of a few of the best MBs ... kinda like Compaq did,
same thing but by novel, non-copywrit means.

What, don't want to pay ? Well then .... enjoy Win 12/13/14 ...
because that and Apple are gonna be all there is forever.

Re: uefi malware--threat to all?

<tu6pp1$apl4$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11913&group=comp.os.linux.misc#11913

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 08:40:17 +0100
Organization: A noiseless patient Spider
Lines: 10
Message-ID: <tu6pp1$apl4$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
<tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 07:40:17 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="73cdf85411c8a30bd424af2854a4d18f";
logging-data="353956"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19GJgWpf8GKzzoY5rkZ/qsn"
Cancel-Lock: sha1:0vxvGdajbe0bd8Q4UQs5defknaI=
 by: Marco Moock - Tue, 7 Mar 2023 07:40 UTC

Am 07.03.2023 schrieb pH <wNOSPAMp@gmail.org>:

> I'm gathering that secure boot is actually a *good* thing and not
> just some microsoft introduction.

If it is implemented properly and can be disabled if the user wishes it,
it is a good thing. Sadly, some motherboard don't have a proper
implementation and make the installation of other operating systems
difficult.

Re: uefi malware--threat to all?

<tu6psn$apl4$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11914&group=comp.os.linux.misc#11914

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 08:42:15 +0100
Organization: A noiseless patient Spider
Lines: 14
Message-ID: <tu6psn$apl4$2@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
<tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
<tu630a$4hb3$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 07:42:15 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="73cdf85411c8a30bd424af2854a4d18f";
logging-data="353956"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/NLCzk3tDzLRUpt/qBDMzC"
Cancel-Lock: sha1:N23G+I8wC22LNBvm1kEpnxstgc8=
 by: Marco Moock - Tue, 7 Mar 2023 07:42 UTC

Am 06.03.2023 schrieb Bobbie Sellers <bliss@mouse-potato.com>:

> When installing Linux to a machine with the Secure Boot
> enabled most of us disable it. Some few Linux systems have paid the
> toll to Microsoft and gotten a key which will satisfy the Secure Boot
> system. When using Windows and any Linux system on the same hardware
> you must be aware that Windows without warnings sends new kernels to
> the system and when that happens the previous boot setting are
> over-written messing up the Linux boot as well. You will need a Live
> Linux Distribution to fix the broken boot syste.

This only applies for BIOS boot. With UEFI boot, only the boot order
changes, so it is possible to change it easily in the UEFI settings.

Re: uefi malware--threat to all?

<vv7jdjx518.ln2@Telcontar.valinor>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11916&group=comp.os.linux.misc#11916

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E.R.)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 09:07:59 +0100
Lines: 68
Message-ID: <vv7jdjx518.ln2@Telcontar.valinor>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Trace: individual.net DQf0ak2Ar651TNdthcj23wxtIah5RO4+9S9jG05fw7Fz5hpGCH
X-Orig-Path: Telcontar.valinor!not-for-mail
Cancel-Lock: sha1:qjAgFwvqFi+EhiEi92G+HFUtPX0=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Content-Language: es-ES, en-CA
In-Reply-To: <tu630a$4hb3$1@dont-email.me>
 by: Carlos E.R. - Tue, 7 Mar 2023 08:07 UTC

On 2023-03-07 02:11, Bobbie Sellers wrote:
> On 3/6/23 16:36, pH wrote:
>> On 2023-03-06, Marco Moock <mo01@posteo.de> wrote:
>>> Am 06.03.2023 um 18:13:14 Uhr schrieb pH:
>>>
>>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>>
>>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>>
>>>> I'm assuming since this runs first, Linux is therefore not immune to
>>>> this malware.
>>>>
>>>> Would a workaround be enabling legacy boot and running an older distro
>>>> until...well, I'll wait for any comments from you smarter guys out
>>>> there.
>>>
>>> No, classic BIOS boot (called CSM/legacy when UEFI firmware is being
>>> used) doesn't contain SecureBoot at all. If a software can change the
>>> boot loader, it can infect every system.
>>>
>>> Also attacks on the firmware directly are still possible, just like a
>>> normal BIOS/UEFI firmware update.
>>>
>>
>> OKay, thanks for the comments.
>>
>> I'm gathering that secure boot is actually a *good* thing and not just
>> some
>> microsoft introduction.
>>
>> Since I install so seldom I'm really not up on these things.
>>
>> pH
>     Secure Boot is not a good thing but a Microsoft attempt to satisfy
> it's corporate customers and to lock out the possibility of
> using Linux on a Windows machine.  There are further attempts to
> foreclose the possibility of using a secure OS on machines installed
> with Windows.  In corporate circumstances it locks down the systems
> against unauthorized intrusions by any but the assigned IP technicians.
> Just to point out than many corporate users will learn enough to turn
> it off but it does provide a little security.
>
>     When installing Linux to a machine with the Secure Boot enabled
> most of us disable it.  Some few Linux systems have paid the toll to
> Microsoft and gotten a key which will satisfy the Secure Boot system.
> When using Windows and any Linux system on the same hardware you must
> be aware that Windows without warnings sends new kernels to the system
> and when that happens the previous boot setting are over-written messing
> up the Linux boot as well.  You will need a Live Linux Distribution to
> fix the broken boot syste.

Hasn't ever happened to me.

I only heard some histories, long ago, of some vendors, not Microsoft,
selling machines with incorrect firmware that would not allow different
installs.

Same as there are (were?) motherboards that are designed incompatible
with Linux.

This is just paranoia.

--
Cheers, Carlos.

Re: uefi malware--threat to all?

<tu7k7o$2nbn$1@paganini.bofh.team>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11921&group=comp.os.linux.misc#11921

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!paganini.bofh.team!not-for-mail
From: no-email@invalid.invalid (Andrei Z.)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 18:11:52 +0300
Organization: To protect and to server
Message-ID: <tu7k7o$2nbn$1@paganini.bofh.team>
References: <tu5afp$qf3$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 15:11:52 -0000 (UTC)
Injection-Info: paganini.bofh.team; logging-data="89463"; posting-host="rxkh9OkzK1NjfpMLLxfORw.user.paganini.bofh.team"; mail-complaints-to="usenet@bofh.team"; posting-account="9dIQLXBM7WM9KzA+yjdR4A";
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Cancel-Lock: sha256:iw7VcJrL2AqAwvwr/uhXu3DJxuJY0qgFlxCC8/CNcTk=
X-Notice: Filtered by postfilter v. 0.9.3
Content-Language: en-GB
 by: Andrei Z. - Tue, 7 Mar 2023 15:11 UTC

pH wrote:
> I just saw this article in google news today.
>
> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>
> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>
> I'm assuming since this runs first, Linux is therefore not immune to this
> malware.
>
> Would a workaround be enabling legacy boot and running an older distro
> until...well, I'll wait for any comments from you smarter guys out there.
>
> pH in Aptos

TCG TPM2.0 implementations vulnerable to memory corruption

Vulnerability Note VU#782720
Original Release Date: 2023-02-28 | Last Revised: 2023-03-06

https://kb.cert.org/vuls/id/782720

Trusted Platform Module - Wikipedia
https://en.wikipedia.org/wiki/Trusted_Platform_Module

Re: uefi malware--threat to all?

<tu7n5l$f4lj$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11922&group=comp.os.linux.misc#11922

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: bliss@mouse-potato.com (Bobbie Sellers)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 08:01:57 -0800
Organization: dis-organization
Lines: 27
Message-ID: <tu7n5l$f4lj$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<tu6psn$apl4$2@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 7 Mar 2023 16:01:57 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="5b72655cb687845539958fb52433276f";
logging-data="496307"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18xB7nN7LfXeVxFVl1FRNbI"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Cancel-Lock: sha1:lie6l2+H0nuEJn/ESSfSGEQTZm4=
In-Reply-To: <tu6psn$apl4$2@dont-email.me>
Content-Language: en-US
 by: Bobbie Sellers - Tue, 7 Mar 2023 16:01 UTC

On 3/6/23 23:42, Marco Moock wrote:
> Am 06.03.2023 schrieb Bobbie Sellers <bliss@mouse-potato.com>:
>
>> When installing Linux to a machine with the Secure Boot
>> enabled most of us disable it. Some few Linux systems have paid the
>> toll to Microsoft and gotten a key which will satisfy the Secure Boot
>> system. When using Windows and any Linux system on the same hardware
>> you must be aware that Windows without warnings sends new kernels to
>> the system and when that happens the previous boot setting are
>> over-written messing up the Linux boot as well. You will need a Live
>> Linux Distribution to fix the broken boot syste.
>
> This only applies for BIOS boot. With UEFI boot, only the boot order
> changes, so it is possible to change it easily in the UEFI settings.
>
No it overwrites the Linux EFI information.
Having Windows on a Linux machine is equivalent to a Trojan
or worse. Now-a-days (Oh you moderns) you can run Linux from
a Flash Drive with a persistent partition for your work so
there is no need for an installation.

bliss-“Nearly any fool can use a GNU/Linux computer. Many do"
After all here I am...Again...

--
bliss dash SF 4 ever at dslextreme dot com

Re: uefi malware--threat to all?

<tu7puk$fp0a$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11923&group=comp.os.linux.misc#11923

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: tnp@invalid.invalid (The Natural Philosopher)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 16:49:24 +0000
Organization: A little, after lunch
Lines: 34
Message-ID: <tu7puk$fp0a$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<tu6psn$apl4$2@dont-email.me> <tu7n5l$f4lj$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 7 Mar 2023 16:49:24 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="544827c6f6ede7d2efe0675d6ac2b59f";
logging-data="517130"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX192VcojRkXTFuKbv0aI/jYYYUAenw0EDso="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.7.1
Cancel-Lock: sha1:7NyrOcIi0O2IJMcPs2Eb+ekDmpc=
In-Reply-To: <tu7n5l$f4lj$1@dont-email.me>
Content-Language: en-GB
 by: The Natural Philosop - Tue, 7 Mar 2023 16:49 UTC

On 07/03/2023 16:01, Bobbie Sellers wrote:
> On 3/6/23 23:42, Marco Moock wrote:
>> Am 06.03.2023 schrieb Bobbie Sellers <bliss@mouse-potato.com>:
>>
>>> When installing Linux to a machine with the Secure Boot
>>> enabled most of us disable it.  Some few Linux systems have paid the
>>> toll to Microsoft and gotten a key which will satisfy the Secure Boot
>>> system. When using Windows and any Linux system on the same hardware
>>> you must be aware that Windows without warnings sends new kernels to
>>> the system and when that happens the previous boot setting are
>>> over-written messing up the Linux boot as well.  You will need a Live
>>> Linux Distribution to fix the broken boot syste.
>>
>> This only applies for BIOS boot. With UEFI boot, only the boot order
>> changes, so it is possible to change it easily in the UEFI settings.
>>
>     No it overwrites the Linux EFI information.
>  Having Windows on a Linux machine is equivalent to a Trojan
> or worse.  Now-a-days (Oh you moderns) you can run Linux from
> a Flash Drive with a persistent partition for your work so
> there is no need for an installation.
>
> bliss-“Nearly any fool can use a GNU/Linux computer. Many do"
> After all here I am...Again...
>
Seriously unless you are short on hardware and need windows to run
real-time games, It is always better to run Linux natively and have
windows in a VM.
If you have 8GB RAM anyway.

--
To ban Christmas, simply give turkeys the vote.

Re: uefi malware--threat to all?

<op.11f6ycmaa3w0dxdave@hodgins.homeip.net>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11924&group=comp.os.linux.misc#11924

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: dwhodgins@nomail.afraid.org (David W. Hodgins)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 07 Mar 2023 13:00:02 -0500
Organization: A noiseless patient Spider
Lines: 23
Message-ID: <op.11f6ycmaa3w0dxdave@hodgins.homeip.net>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: 8bit
Injection-Info: reader01.eternal-september.org; posting-host="311a965122767d0c3c82730221514f96";
logging-data="542269"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/B3prKEg1syU96CcLyYEx/I0x7M4yXsEI="
User-Agent: Opera Mail/12.16 (Linux)
Cancel-Lock: sha1:Q3UHzekcP592L7a62JZzw5g46AY=
 by: David W. Hodgins - Tue, 7 Mar 2023 18:00 UTC

On Tue, 07 Mar 2023 03:07:59 -0500, Carlos E.R. <robin_listas@es.invalid> wrote:
> I only heard some histories, long ago, of some vendors, not Microsoft,
> selling machines with incorrect firmware that would not allow different
> installs.
> Same as there are (were?) motherboards that are designed incompatible
> with Linux.

https://arstechnica.com/information-technology/2012/01/microsoft-mandating-secure-boot-on-arm-making-linux-installs-difficult/

Also on x86 systems, having the ability to turn off secure boot is up to the
uefi firmware developers, so may or may not work on a given system.

Configuration screens for uefi vary widely among and even with versions of
different vendor's firmware in terms of organization and terminology.

M$ can't ban other operating systems, but they do as much as they think they can
get away with to make it more difficult.

Having a mini-os that you don't control that has full control of the hardware
drastically increases the attack surface for adversaries. It makes it easier
for them to make intrusions persistent, and harder to detect.

Regards, Dave Hodgins

Re: uefi malware--threat to all?

<tu7uj0$gd3a$5@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11925&group=comp.os.linux.misc#11925

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 19:08:32 +0100
Organization: A noiseless patient Spider
Lines: 29
Message-ID: <tu7uj0$gd3a$5@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
<tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
<tu630a$4hb3$1@dont-email.me>
<tu6psn$apl4$2@dont-email.me>
<tu7n5l$f4lj$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 18:08:32 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="94456a3001538a40e37a56f7e436fe31";
logging-data="537706"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18OcNETOR3q+QKbeYrSjmFc"
Cancel-Lock: sha1:eFq7BSDd0TEfwbfO2SYnfvE3r9Y=
 by: Marco Moock - Tue, 7 Mar 2023 18:08 UTC

Am 07.03.2023 um 08:01:57 Uhr schrieb Bobbie Sellers:

> On 3/6/23 23:42, Marco Moock wrote:
> > Am 06.03.2023 schrieb Bobbie Sellers <bliss@mouse-potato.com>:
> >
> >> When installing Linux to a machine with the Secure Boot
> >> enabled most of us disable it. Some few Linux systems have paid
> >> the toll to Microsoft and gotten a key which will satisfy the
> >> Secure Boot system. When using Windows and any Linux system on the
> >> same hardware you must be aware that Windows without warnings
> >> sends new kernels to the system and when that happens the previous
> >> boot setting are over-written messing up the Linux boot as well.
> >> You will need a Live Linux Distribution to fix the broken boot
> >> syste.
> >
> > This only applies for BIOS boot. With UEFI boot, only the boot order
> > changes, so it is possible to change it easily in the UEFI settings.
> >
> No it overwrites the Linux EFI information.

I haven't experienced that yet.

> Having Windows on a Linux machine is equivalent to a Trojan
> or worse. Now-a-days (Oh you moderns) you can run Linux from
> a Flash Drive with a persistent partition for your work so
> there is no need for an installation.

I prefer Linux installed and windows locked in in Virtualbox. :-)

Re: uefi malware--threat to all?

<tu7uke$gd3a$6@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11926&group=comp.os.linux.misc#11926

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 19:09:18 +0100
Organization: A noiseless patient Spider
Lines: 12
Message-ID: <tu7uke$gd3a$6@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
<tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
<tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 18:09:18 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="94456a3001538a40e37a56f7e436fe31";
logging-data="537706"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19gqXdA3EJk1bO7muPQVmGi"
Cancel-Lock: sha1:SQfx7BIqi8otucWfKHNCg0K1mLg=
 by: Marco Moock - Tue, 7 Mar 2023 18:09 UTC

Am 07.03.2023 um 09:07:59 Uhr schrieb Carlos E.R.:

> I only heard some histories, long ago, of some vendors, not
> Microsoft, selling machines with incorrect firmware that would not
> allow different installs.
>
> Same as there are (were?) motherboards that are designed incompatible
> with Linux.

Acer and Medion were candidates where GNU/Linux installation with
LILO/GRUB was difficult, but still possible.

Re: uefi malware--threat to all?

<tu7uli$gd3a$7@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11927&group=comp.os.linux.misc#11927

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: mo01@posteo.de (Marco Moock)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 19:09:54 +0100
Organization: A noiseless patient Spider
Lines: 10
Message-ID: <tu7uli$gd3a$7@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me>
<tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me>
<tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor>
<op.11f6ycmaa3w0dxdave@hodgins.homeip.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 18:09:54 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="94456a3001538a40e37a56f7e436fe31";
logging-data="537706"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+hGDhYIPwwjL6c0GqUQ0EL"
Cancel-Lock: sha1:EalZAxXRit0QmbFzkmokIa+UNNg=
 by: Marco Moock - Tue, 7 Mar 2023 18:09 UTC

Am 07.03.2023 um 13:00:02 Uhr schrieb David W. Hodgins:

> Having a mini-os that you don't control that has full control of the
> hardware drastically increases the attack surface for adversaries. It
> makes it easier for them to make intrusions persistent, and harder to
> detect.

True - but that already existed in the BIOS times with Intels
Management Engine (ME).

Re: uefi malware--threat to all?

<op.11gcb6q3a3w0dxdave@hodgins.homeip.net>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11928&group=comp.os.linux.misc#11928

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: dwhodgins@nomail.afraid.org (David W. Hodgins)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 07 Mar 2023 14:56:20 -0500
Organization: A noiseless patient Spider
Lines: 18
Message-ID: <op.11gcb6q3a3w0dxdave@hodgins.homeip.net>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor> <op.11f6ycmaa3w0dxdave@hodgins.homeip.net>
<tu7uli$gd3a$7@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: 8bit
Injection-Info: reader01.eternal-september.org; posting-host="311a965122767d0c3c82730221514f96";
logging-data="579467"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/1Md/56Ntthui/7ZC1y0B7Qan0emeMpWc="
User-Agent: Opera Mail/12.16 (Linux)
Cancel-Lock: sha1:T+CMnTrnQmp2yu2LDoTtcOKyERY=
 by: David W. Hodgins - Tue, 7 Mar 2023 19:56 UTC

On Tue, 07 Mar 2023 13:09:54 -0500, Marco Moock <mo01@posteo.de> wrote:

> Am 07.03.2023 um 13:00:02 Uhr schrieb David W. Hodgins:
>
>> Having a mini-os that you don't control that has full control of the
>> hardware drastically increases the attack surface for adversaries. It
>> makes it easier for them to make intrusions persistent, and harder to
>> detect.
>
> True - but that already existed in the BIOS times with Intels
> Management Engine (ME).

That's true, but was easier to avoid or fully disable. With uefi, it can't be
fully disabled. The uefi firmware always has full control before the os loads.
The legacy boot options only emulate the bios firmware interface. They don't
stop uefi from being in control of the hardware.

Regards, Dave Hodgins

Re: uefi malware--threat to all?

<tu87ob$hunh$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11929&group=comp.os.linux.misc#11929

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: wNOSPAMp@gmail.org (pH)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 20:44:59 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 38
Message-ID: <tu87ob$hunh$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu7k7o$2nbn$1@paganini.bofh.team>
Injection-Date: Tue, 7 Mar 2023 20:44:59 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="384fee31552595185e2f0f8c450ba8e0";
logging-data="588529"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+nN5Srx19qS4iHeNAcQyhFbicDt5bonDQ="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:dhB2jzlMT0pFPugEd55rkr5kYfI=
 by: pH - Tue, 7 Mar 2023 20:44 UTC

On 2023-03-07, Andrei Z. <no-email@invalid.invalid> wrote:
> pH wrote:
>> I just saw this article in google news today.
>>
>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>
>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>
>> I'm assuming since this runs first, Linux is therefore not immune to this
>> malware.
>>
>> Would a workaround be enabling legacy boot and running an older distro
>> until...well, I'll wait for any comments from you smarter guys out there.
>>
>> pH in Aptos
>
> TCG TPM2.0 implementations vulnerable to memory corruption
>
> Vulnerability Note VU#782720
> Original Release Date: 2023-02-28 | Last Revised: 2023-03-06
>
> https://kb.cert.org/vuls/id/782720
>
> Trusted Platform Module - Wikipedia
> https://en.wikipedia.org/wiki/Trusted_Platform_Module
>

So, what two or three steps might one want to do before installing, say,
Mint 20.3 or anything recent...

In my case, I just got into the bios and had it boot from DVD/CD first.
I remember turning something "off" on that same page, but don't recall what
it was now. This was a cheap Lenovo (IBM) laptop. Works fine so far.

o turn off "secure boot"
anything else?

pH

Re: uefi malware--threat to all?

<op.11ggr4pfa3w0dxdave@hodgins.homeip.net>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11931&group=comp.os.linux.misc#11931

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: dwhodgins@nomail.afraid.org (David W. Hodgins)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 07 Mar 2023 16:32:18 -0500
Organization: A noiseless patient Spider
Lines: 24
Message-ID: <op.11ggr4pfa3w0dxdave@hodgins.homeip.net>
References: <tu5afp$qf3$1@dont-email.me> <tu7k7o$2nbn$1@paganini.bofh.team>
<tu87ob$hunh$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: 8bit
Injection-Info: reader01.eternal-september.org; posting-host="311a965122767d0c3c82730221514f96";
logging-data="610163"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+ecwQITZM2cbMEYyxQtbO8LueKi8+roog="
User-Agent: Opera Mail/12.16 (Linux)
Cancel-Lock: sha1:whwXVGscFT/TN5rcua4e+s52I3A=
 by: David W. Hodgins - Tue, 7 Mar 2023 21:32 UTC

On Tue, 07 Mar 2023 15:44:59 -0500, pH <wNOSPAMp@gmail.org> wrote:
> So, what two or three steps might one want to do before installing, say,
> Mint 20.3 or anything recent...
>
> In my case, I just got into the bios and had it boot from DVD/CD first.
> I remember turning something "off" on that same page, but don't recall what
> it was now. This was a cheap Lenovo (IBM) laptop. Works fine so far.
>
> o turn off "secure boot"
> anything else?

I haven't looked at Lenovo specificall. In general ...
Disable secure boot
Use Achi mode for sata controller(s).
Disable RST (Intel Rapid Storage Technology) if present.

If dual booting with windows
Disable Fast Startup (aka Fastboot) in windows, or the windows partition(s)
will not be mountable or shrinkable.
For some systems, the uefi firmware will still boot windows ignoring the
linux boot loader. For those, in windows it will be necessary to use bcedit
to alter the boot selection order. See https://wiki.mageia.org/en/Mageia_in_dual_boot_with_Windows8_and_over#Windows_starts_directly

Regards, Dave Hodgins

Re: uefi malware--threat to all?

<tu8arp$fsgs$5@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11932&group=comp.os.linux.misc#11932

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: tnp@invalid.invalid (The Natural Philosopher)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 21:38:01 +0000
Organization: A little, after lunch
Lines: 50
Message-ID: <tu8arp$fsgs$5@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu7k7o$2nbn$1@paganini.bofh.team>
<tu87ob$hunh$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 7 Mar 2023 21:38:01 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="544827c6f6ede7d2efe0675d6ac2b59f";
logging-data="520732"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+U0Zh/HDlPKOjISGQIxtYcDHP/e7qwvfQ="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.7.1
Cancel-Lock: sha1:EGmAToxIjks0cx97FBM+5nVNAl0=
In-Reply-To: <tu87ob$hunh$1@dont-email.me>
Content-Language: en-GB
 by: The Natural Philosop - Tue, 7 Mar 2023 21:38 UTC

On 07/03/2023 20:44, pH wrote:
> On 2023-03-07, Andrei Z. <no-email@invalid.invalid> wrote:
>> pH wrote:
>>> I just saw this article in google news today.
>>>
>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>
>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>
>>> I'm assuming since this runs first, Linux is therefore not immune to this
>>> malware.
>>>
>>> Would a workaround be enabling legacy boot and running an older distro
>>> until...well, I'll wait for any comments from you smarter guys out there.
>>>
>>> pH in Aptos
>>
>> TCG TPM2.0 implementations vulnerable to memory corruption
>>
>> Vulnerability Note VU#782720
>> Original Release Date: 2023-02-28 | Last Revised: 2023-03-06
>>
>> https://kb.cert.org/vuls/id/782720
>>
>> Trusted Platform Module - Wikipedia
>> https://en.wikipedia.org/wiki/Trusted_Platform_Module
>>
>
> So, what two or three steps might one want to do before installing, say,
> Mint 20.3 or anything recent...
>
> In my case, I just got into the bios and had it boot from DVD/CD first.
> I remember turning something "off" on that same page, but don't recall what
> it was now. This was a cheap Lenovo (IBM) laptop. Works fine so far.
>
> o turn off "secure boot"
> anything else?
>
> pH

Last machine I got had Winders on it. I just plugged a stick in and used
the bios to boot from it - latest Mint. Mint seemed to doiUEFI shit
without me having to wipe its bottom, so I guess it's potty trained by now.

--
"I guess a rattlesnake ain't risponsible fer bein' a rattlesnake, but ah
puts mah heel on um jess the same if'n I catches him around mah chillun".

Re: uefi malware--threat to all?

<1ZKdnSLOSa7gaJr5nZ2dnZfqnPadnZ2d@earthlink.com>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11935&group=comp.os.linux.misc#11935

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!news.misty.com!border-2.nntp.ord.giganews.com!nntp.giganews.com!Xl.tags.giganews.com!local-1.nntp.ord.giganews.com!nntp.earthlink.com!news.earthlink.com.POSTED!not-for-mail
NNTP-Posting-Date: Wed, 08 Mar 2023 02:39:57 +0000
Subject: Re: uefi malware--threat to all?
Newsgroups: comp.os.linux.misc
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor> <tu7uke$gd3a$6@dont-email.me>
From: 28B.I874@noabzba.net (28B.I874)
Organization: gear transect
Date: Tue, 7 Mar 2023 21:39:38 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <tu7uke$gd3a$6@dont-email.me>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Message-ID: <1ZKdnSLOSa7gaJr5nZ2dnZfqnPadnZ2d@earthlink.com>
Lines: 33
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 68.222.41.46
X-Trace: sv3-BUGefF7RLObIP5jBPsOBI5sU2Lm4BUK9yJJnKiKPNpHcwEXImxOWZmMQTELzIwHpRsa9JNcFkLO1GPw!/0qH0FlRyjLGTSubPVp3MoJId7lGZs9cOvAyDwblT8nCFfHeaZVFWMRQq/0W+0ibm5kgVd0kGw2R!ykXKms9IGHhdLBsWSY0=
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
 by: 28B.I874 - Wed, 8 Mar 2023 02:39 UTC

On 3/7/23 1:09 PM, Marco Moock wrote:
> Am 07.03.2023 um 09:07:59 Uhr schrieb Carlos E.R.:
>
>> I only heard some histories, long ago, of some vendors, not
>> Microsoft, selling machines with incorrect firmware that would not
>> allow different installs.
>>
>> Same as there are (were?) motherboards that are designed incompatible
>> with Linux.
>
> Acer and Medion were candidates where GNU/Linux installation with
> LILO/GRUB was difficult, but still possible.

Note that if it's difficult ENOUGH then Linux/UNIX gets
relegated to a crusty few - of no interest to anyone
else, not used by anyone else either. It becomes a
"hobby" OS only, no relevance in the world. Development
pretty much ends. This is the M$/Apple DREAM - total
uncontested world dominance, all profits for THEM only.

Then they'll boost the OS cost to a few kilobucks up
front, and you can't even buy it, just "lease" it.
Every update, every hour, more $$$ too. Pay-per-View,
kinda back to the old terminals/server model. TELL
me the giant push for Online-Only primary apps isn't
exactly that.

M$ owns enough Apple stock, and vice-versa, so it barely
even matters which you buy, they both make money.

Yea, yea, IBM will have it's own Linux/UNIX-ish OS for
their big hardware - but YOU ain't gonna be buying those
mainframes.

Re: uefi malware--threat to all?

<op.11gxkslqa3w0dxdave@hodgins.homeip.net>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11937&group=comp.os.linux.misc#11937

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: dwhodgins@nomail.afraid.org (David W. Hodgins)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 07 Mar 2023 22:35:06 -0500
Organization: A noiseless patient Spider
Lines: 22
Message-ID: <op.11gxkslqa3w0dxdave@hodgins.homeip.net>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<vv7jdjx518.ln2@Telcontar.valinor> <tu7uke$gd3a$6@dont-email.me>
<1ZKdnSLOSa7gaJr5nZ2dnZfqnPadnZ2d@earthlink.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
Content-Transfer-Encoding: 8bit
Injection-Info: reader01.eternal-september.org; posting-host="a6eb09ffe2a3582cf78a646ee325a40a";
logging-data="809580"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19pTr+Nm7O+LTnhddHkfHMrGKgJ+SkJFKQ="
User-Agent: Opera Mail/12.16 (Linux)
Cancel-Lock: sha1:WwVWe6dLBiWYvKGZg5Ml+IIqnGQ=
 by: David W. Hodgins - Wed, 8 Mar 2023 03:35 UTC

On Tue, 07 Mar 2023 21:39:38 -0500, 28B.I874 <28B.I874@noabzba.net> wrote:
> Note that if it's difficult ENOUGH then Linux/UNIX gets
> relegated to a crusty few - of no interest to anyone
> else, not used by anyone else either. It becomes a
> "hobby" OS only, no relevance in the world. Development
> pretty much ends. This is the M$/Apple DREAM - total
> uncontested world dominance, all profits for THEM only.

Community based linux distributions don't need to satisfy anyone that doesn't
contribute in one way or another to it's creation and maintenance, and the
friends and/or family members they want it for. By contribute, I'm including
both those who donate their time, and those who donate money to pay for the
infrastructure. While those distributions do welcome additional users, they don't
need them for the distribution to survive.

Market share doesn't matter for the non-commercial distributions. For the
commercial distributions they only need enough companies or people willing to
pay for their support services to keep their shareholders satisfied and the
bills/staff paid. Anything beyond that is just extra money for the shareholders,
or employees who's pay depends on revenue.

Regards, Dave Hodgins

Re: uefi malware--threat to all?

<tu96o3$plh7$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11938&group=comp.os.linux.misc#11938

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: bliss@mouse-potato.com (Bobbie Sellers)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 21:33:55 -0800
Organization: dis-organization
Lines: 37
Message-ID: <tu96o3$plh7$1@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu5h5u$j3i$3@dont-email.me>
<tu60tv$49m8$1@dont-email.me> <tu630a$4hb3$1@dont-email.me>
<tu6psn$apl4$2@dont-email.me> <tu7n5l$f4lj$1@dont-email.me>
<tu7uj0$gd3a$5@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Wed, 8 Mar 2023 05:33:56 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="b4fb73c86c631462b672934e333868bb";
logging-data="841255"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18Y/1PyhNOLm51gf3Pp4YTD"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Cancel-Lock: sha1:ThhJt/nRnmZmohopilYyub3xPBw=
In-Reply-To: <tu7uj0$gd3a$5@dont-email.me>
Content-Language: en-US
 by: Bobbie Sellers - Wed, 8 Mar 2023 05:33 UTC

On 3/7/23 10:08, Marco Moock wrote:
> Am 07.03.2023 um 08:01:57 Uhr schrieb Bobbie Sellers:
>
>> On 3/6/23 23:42, Marco Moock wrote:
>>> Am 06.03.2023 schrieb Bobbie Sellers <bliss@mouse-potato.com>:
>>>
>>>> When installing Linux to a machine with the Secure Boot
>>>> enabled most of us disable it. Some few Linux systems have paid
>>>> the toll to Microsoft and gotten a key which will satisfy the
>>>> Secure Boot system. When using Windows and any Linux system on the
>>>> same hardware you must be aware that Windows without warnings
>>>> sends new kernels to the system and when that happens the previous
>>>> boot setting are over-written messing up the Linux boot as well.
>>>> You will need a Live Linux Distribution to fix the broken boot
>>>> syste.
>>>
>>> This only applies for BIOS boot. With UEFI boot, only the boot order
>>> changes, so it is possible to change it easily in the UEFI settings.
>>>
>> No it overwrites the Linux EFI information.
>
> I haven't experienced that yet.
>
>> Having Windows on a Linux machine is equivalent to a Trojan
>> or worse. Now-a-days (Oh you moderns) you can run Linux from
>> a Flash Drive with a persistent partition for your work so
>> there is no need for an installation.
>
> I prefer Linux installed and windows locked in in Virtualbox. :-)

Sounds good to me.

bliss - old and tired tonight.

--
bliss dash SF 4 ever at dslextreme dot com

Re: uefi malware--threat to all?

<tu970m$plh7$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=11939&group=comp.os.linux.misc#11939

  copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: bliss@mouse-potato.com (Bobbie Sellers)
Newsgroups: comp.os.linux.misc
Subject: Re: uefi malware--threat to all?
Date: Tue, 7 Mar 2023 21:38:29 -0800
Organization: dis-organization
Lines: 50
Message-ID: <tu970m$plh7$2@dont-email.me>
References: <tu5afp$qf3$1@dont-email.me> <tu7k7o$2nbn$1@paganini.bofh.team>
<tu87ob$hunh$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Wed, 8 Mar 2023 05:38:30 -0000 (UTC)
Injection-Info: reader01.eternal-september.org; posting-host="b4fb73c86c631462b672934e333868bb";
logging-data="841255"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+6tHMir/iAFDcU+2HcpjJS"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.8.0
Cancel-Lock: sha1:zNF8O5+FQ42NTxDyaYxUoNEfXps=
In-Reply-To: <tu87ob$hunh$1@dont-email.me>
Content-Language: en-US
 by: Bobbie Sellers - Wed, 8 Mar 2023 05:38 UTC

On 3/7/23 12:44, pH wrote:
> On 2023-03-07, Andrei Z. <no-email@invalid.invalid> wrote:
>> pH wrote:
>>> I just saw this article in google news today.
>>>
>>> https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/
>>>
>>> I'm not up on my acronyms, but I've seen uefi mentioned here at times.
>>>
>>> I'm assuming since this runs first, Linux is therefore not immune to this
>>> malware.
>>>
>>> Would a workaround be enabling legacy boot and running an older distro
>>> until...well, I'll wait for any comments from you smarter guys out there.
>>>
>>> pH in Aptos
>>
>> TCG TPM2.0 implementations vulnerable to memory corruption
>>
>> Vulnerability Note VU#782720
>> Original Release Date: 2023-02-28 | Last Revised: 2023-03-06
>>
>> https://kb.cert.org/vuls/id/782720
>>
>> Trusted Platform Module - Wikipedia
>> https://en.wikipedia.org/wiki/Trusted_Platform_Module
>>
>
> So, what two or three steps might one want to do before installing, say,
> Mint 20.3 or anything recent...
>
> In my case, I just got into the bios and had it boot from DVD/CD first.
> I remember turning something "off" on that same page, but don't recall what
> it was now. This was a cheap Lenovo (IBM) laptop. Works fine so far.
>
> o turn off "secure boot"
> anything else?
>
> pH

If you have Windows on the machine make sure Fast Boot is turned off
and that Windows completely shuts down when you leave it. No
Hibernation or Suspend for Windows.
If it is not shut down it may retain hooks that will make it difficult
for Linux.

bliss- still old and tired.
--
bliss dash SF 4 ever at dslextreme dot com

Pages:12345
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor