Re: [GIT PULL] Load keys from signed PE binaries

From: Chris Friesen
Date: Wed Feb 27 2013 - 14:22:03 EST

On 02/27/2013 11:59 AM, Theodore Ts'o wrote:
On Wed, Feb 27, 2013 at 11:36:09AM -0600, Chris Friesen wrote:
At this point you've got a running infected Win8 install that is
running on Secure Boot hardware but is actually running malware.

Admittedly this would be tricky to do reliably in a way that the
user doesn't notice, so it may not actually be a real-world threat.

That's another thing which is extraordinarily vague. What counts as
"user doesn't notice"? If a whole bunch of kernel messages scroll by,
is that enough? What if a Penguin jpg shows up for a minimum 5
seconds? 15 seconds? 30 seconds?

I think it'd need to be "doesn't notice operationally when running the virtualized Windows install".

Anyone going through all the trouble to virtualize an existing install could probably arrange to have the target computer do the conversion at a time when nobody is likely to be around.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at