|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
ON SECURITY By Susan Bradley During the last few months, some chinks have appeared in Secure Boot’s armor as the result of various attacks and vulnera
[See the full post at: Is Secure Boot important for security?]
Susan Bradley Patch Lady/Prudent patcher
NO! Do not change from legacy BIOS to UEFI. Tried it once. No fun. Unbootable.
Also, never use a legacy boot flash stick on a UEFI hard drive. Also not nice.
Update: If you use a third-party antivirus tool, you will not be able to use ASR rules as they work only with Defender. Microsoft makes it incredible difficult to implement and provides deficient instructions. This page is helpful: https://www.csoonline.com/article/3597407/how-to-use-windows-defender-attack-surface-reduction-rules.html
In my working environment, I’m not convinced that it is.
I’m just putting up a new machine, a bare-bones ASUS PN-51. Similar to an Intel NUC, one of those that has lots of stuff bundled with the motherboard, and where I specify memory and storage.
For this particular installation, I doing it as a Linux installation, and before I got into serious configuration work, I did some playing with more than one Linux distro. I had no problems installing Ubuntu 22.04, but when I tried installing Mint 21.1, I got conflicts coming from SecureBoot.
Apparently, the Mint 22.1 installer has new keys on it that are unrecognized. I guess there are ways of signing an installer, but most of the information out there is pretty cryptic, unless you’re really familiar with both boot processes and signature keys, and how they intersect in UEFI. I ended up disabling SecureBoot and Mint installs fine — and I don’t know if I’ll get around to reenabling SecureBoot or not.
I didn’t check, but I suppose that it’s possible that other boot images released since the beginning of 2023 might have similar issues, such as Ubuntu 23.04 or the latest release of Fedora Desktop. I also didn’t check with an older version of Mint, such as 21.0 or 20.3.
My sense is that if you’re in an environment where there’s reason to believe the possibility of somebody trying to boot from an unauthorized image, SecureBoot is probably something that you want. But for a one-off boot used for a system install that you’re not expecting to replace, I’m inclined to think may be more of a problem than a benefit. It may not be a huge issue if the installer you need is signed correctly and the signature is recognized, but as with my case, if a UEFI isn’t updated recently enough for the installer I want, I’m not going to take the time to try to figure out how to apply the signature myself, and it’s faster/easier to simply disable SecureBoot.
If the people who consider SecureBoot to be essential for widespread use (especially non-Windows), then it’s necessary to make sure that the signatures of new distros are implemented quickly (at least for the most common Linux distros) and/or there is usable documentation for user-level signing.
Susan,
My advice to my clients has been consistent for years. The best anti-virus/anti-malware protection is right between your ears. Use it regularly before clicking on ANYTHING.
To underscore this point, my email in the last two days has included bogus Javascript (.js) and Adobe PDF attachments. Delete and don’t look back.
Affirmative. Keeping some ‘old’ images at hand too, when needed. There are stronger distuptive forces present since the war in eastern Europe. This early morning there was a giant “glitch” in the DNS system resolving IP’s in your part of this globe.
If the person is close enough to the target machine to run custom boot then they are close enough to log into uefi settings and turn off secure boot. I don’t think it’s secure at all in the sense of protecting the user. The security it protects is mircrosoft marketshare by limiting linux boots and installs. Turning it off is one of the first things I do with a new pc.
…You have a Home with bitlocker?
Hi Susan:
Just an FYI that there was a discussion about the difference between Win 10 Pro BitLocker Drive Encryption vs Win 10 Home Device Encryption in Linda2019’s June 2020 topic BitLocker Drive Encryption Change.
One of the articles I linked to in that 2020 topic refers to Win 10 Home Device Encryption as a “subset of BitLocker” but I did find one Dell support article at Automatic Windows Device Encryption or BitLocker on Dell Computers that states “BitLocker device encryption is supported on a broad range of devices, including those that meet Modern Standby standards and devices that run Windows 10 Home edition or Windows 11“, which blurs the distinction between Bitlocker Disk Encryption and Drive Encryption. I also found multiple users with a Win 10 Home OS reporting that Disk Management (diskmgmt. msc) showed that their disk partitions were already “BitLocker encrypted” when their Dell computer shipped from the factory – see Windows 10 Home BitLocker Encrypted in the Dell forum for one example.
I’m still not clear what encryption method Linda2019 is currently using on their Win 10 Home machine, but it sounds like they can run a manage-bde command from an elevated command prompt to temporarily suspend their encryption before a BIOS update.
————–
Dell Inspiron 5584 * 64-bit Win 10 Pro v22H2 build 19045.2965 * Firefox v113.0.2 * Microsoft Defender v4.18.2304.8-1.1.20300.3 * Malwarebytes Premium v4.5.29.268-1.0.2022 * Macrium Reflect Free v8.0.7279
You still haven’t told us where you got this information?
I will not. There are things one doesn’t share.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
