linux-kernel - Re: [GIT PULL] Load keys from signed PE binaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <512E5C9F.2050800@genband.com>
Date:	Wed, 27 Feb 2013 13:21:03 -0600
From:	Chris Friesen <chris.friesen@...band.com>
To:	Theodore Ts'o <tytso@....edu>, Peter Jones <pjones@...hat.com>,
	Dave Airlie <airlied@...il.com>,
	Greg KH <gregkh@...uxfoundation.org>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	David Howells <dhowells@...hat.com>,
	Florian Weimer <fw@...eb.enyo.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Josh Boyer <jwboyer@...hat.com>,
	Vivek Goyal <vgoyal@...hat.com>,
	Kees Cook <keescook@...omium.org>, keyrings@...ux-nfs.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] Load keys from signed PE binaries

On 02/27/2013 11:59 AM, Theodore Ts'o wrote:
> On Wed, Feb 27, 2013 at 11:36:09AM -0600, Chris Friesen wrote:
>> ...
>> At this point you've got a running infected Win8 install that is
>> running on Secure Boot hardware but is actually running malware.
>>
>> Admittedly this would be tricky to do reliably in a way that the
>> user doesn't notice, so it may not actually be a real-world threat.
>
> That's another thing which is extraordinarily vague.  What counts as
> "user doesn't notice"?  If a whole bunch of kernel messages scroll by,
> is that enough?  What if a Penguin jpg shows up for a minimum 5
> seconds?  15 seconds?  30 seconds?

I think it'd need to be "doesn't notice operationally when running the 
virtualized Windows install".

Anyone going through all the trouble to virtualize an existing install 
could probably arrange to have the target computer do the conversion at 
a time when nobody is likely to be around.

Chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/