Advice Request Windows 8 Secure Boot

[jamescv7]

By now, the 8 seconds Windows 8 boot video demo is bound to be familiar to folks following the evolution of the next version of Windows, including Softpedia readers.

What Microsoft did not reveal when it made the startup demonstration public is the fact that the amazing level of performance is achieved even despite new security enhancements introduced to the boot process.

Secured boot is a new feature which early adopters will be able to test in Windows 8 Developer Preview Build 8102 Milestone 3 (M3) – available for download this week.

Windows 8 secure boot is designed to make the OS more resilient to malicious code created especially to compromise computers even before Windows loads, such as rootkits.

Read More

 

[Deleted member 178]

good feature, they should thought of it earlier

 

[jamescv7]

All I can say that Microsoft Team did very well on security since Windows 8 have packed with built in security and secure boot is included.

 

[Ink]

What's interesting is this:

Windows 8 secure boot to block Linux

Windows 8-certified 64-bit hardware will be forced to carry security measures to stop the installation of other operating systems, such as Linux, until the software is regarded as trusted, according to Microsoft.

Instead of using BIOS for booting Windows 8, hardware carrying the 64-bit version of Microsoft's newest operating system has to use the Unified Extensible Firmware Interface (UEFI) with a secure-booting feature enabled.

Read more (via ZDNet)

Bottom line:
- If you want to dual boot with Linux, you'll have to disable Secure Boot.

 

[jamescv7]

Not bad as long there is a way to disable the secure boot.

This OS will be pretty much easier for the tools to clean infections since its built to prevent rootkits and other nasty things to include in the start up.

 

[Hungry Man]

While I won't be disabling this I hope there's an option. ChromeOS has this but you need to flip a hardware switch to disable it.

 

[Jack]

It seems like Microsoft has changed their mind, Linux will be available even for secure boot.

Microsoft denies secure boot will exclude Linux

Microsoft has hit back at concerns that secure boot technology in UEFI firmware could lock out Linux from Windows 8 PCs, saying that consumers will be free to run whatever they want on their PCs.

Unified Extensible Firmware Interface (UEFI) specifications, designed to reduce start-up times and improve security, allow computers to verify digitally signed OS loaders before booting. The feature in UEFI, the successor to BIOS ROM, is designed as a countermeasure against rootkits and other bootloader nasties.

However computer scientists, including Professor Ross Anderson of Cambridge University, warned earlier this week that the approach would make it impossible to run "unauthorised" OSes such as Linux and FreeBSD on PCs. A signed build of Linux would work, but that would mean persuading OEMs to include the keys.

In addition since the kernel itself is part of the boot process, kernels will also have to be signed, a huge bureaucratic hurdle for developers that runs wholly against the grain of open source software development, as explained in more depth by tech blogger Matthew Garrett here.

If the draft for UEFI is adopted without modification, then systems with secure boot enabled simply will not run a generic copy of Linux. Disabling the feature would allow unsigned code to run. However Garrett argues that since "firmware vendors and OEMs are interested in providing only the minimum of firmware functionality required for their market" this may not be possible, a concern shared by Anderson.

"The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate," he said. Anderson concludes that the approach is even worse than previous attempts to force feed Windows users with DRM technology.

In a blog post on Thursday, Microsoft attempted to address these concerns arguing that "complete control over the PC continues to be available" to consumers.

Secure boot is a UEFI protocol, rather than a specific Windows 8 feature, and "Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows," Microsoft's Tony Mangefeste explains.

"Secure boot doesn’t 'lock out' operating system loaders, but it is a policy that allows firmware to validate authenticity of components. OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform," he adds.

Read more

---

Also in a blog post Microsoft described the implementation of the secure boot sequence that includes UEFI instead of a traditional BIOS underneath the firmware. See : Protecting the pre-OS environment with UEFI

Quick summary:

• UEFI allows firmware to implement a security policy
• Secure boot is a UEFI protocol not a Windows 8 feature
• UEFI secure boot is part of Windows 8 secured boot architecture
• Windows 8 utilizes secure boot to ensure that the pre-OS environment is secure
• Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components
• OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform
• Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows

Windows 8 Secure Boot Demo
Uploaded by minipcpro on Sep 14, 2011

 

[iPanik]

I like this feature. Microsoft said: you have made this feature, we will support it, and if anyone want to use our logo they will enable it by default.
I find that a 100% positive step. Sure it makes life a little harder for the linux people, however people who use linux tend to have a high level of technical knowhow, so i am confident they will find a way

 

[WinAndLinuxTutorials]

Microsoft got their stolen brain back

 

[jamescv7]

The pros here is that secure boot gives you a benefit as protection especially rootkits that tries to run in start up.

The cons that Linux would not allow to boot unless to disable it and the benefit of security will be lessen once disable it.