linux-kernel - Re: [GIT PULL] Load keys from signed PE binaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 28 Feb 2013 22:51:15 +0000
From:	Matthew Garrett <mjg59@...f.ucam.org>
To:	Jiri Kosina <jkosina@...e.cz>
Cc:	David Howells <dhowells@...hat.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	jwboyer@...hat.com, pjones@...hat.com, vgoyal@...hat.com,
	keescook@...omium.org, keyrings@...ux-nfs.org,
	linux-kernel@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>,
	Florian Weimer <fw@...eb.enyo.de>,
	Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [GIT PULL] Load keys from signed PE binaries

On Thu, Feb 28, 2013 at 11:48:06PM +0100, Jiri Kosina wrote:

> Let me formulate my point more clearly -- Microsoft very likely going to 
> sign hello world EFI PE binary, no matter the contents of .keylist 
> section, as they don't give a damn about this section, as it has zero 
> semantic value to them, right?
> 
> They sign the binary. By signing the binary, they are *NOT* establishing 
> cryptographic chain of trust to the key stored in .keylist, but your 
> patchset seems to imply so.

Mr Evil Blackhat's binary is then a mechanism for circumventing the 
Windows trust mechanism, and as such his account is subject to 
termination and his binary can be added to dbx. We'd check the binary 
hash against dbx and refuse to load it on systems that have received the 
update, and Mr Evil Blackhat would have to find a new bunch of identity 
documents to create a new account to repeat the process.

-- 
Matthew Garrett | mjg59@...f.ucam.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/