Re: [GIT PULL] Load keys from signed PE binaries

[Chris Friesen]

On 02/27/2013 11:59 AM, Theodore Ts'o wrote:
> On Wed, Feb 27, 2013 at 11:36:09AM -0600, Chris Friesen wrote:
> > ...
> > At this point you've got a running infected Win8 install that is
> > running on Secure Boot hardware but is actually running malware.
> >
> > Admittedly this would be tricky to do reliably in a way that the
> > user doesn't notice, so it may not actually be a real-world threat.
>
> That's another thing which is extraordinarily vague.  What counts as
> "user doesn't notice"?  If a whole bunch of kernel messages scroll by,
> is that enough?  What if a Penguin jpg shows up for a minimum 5
> seconds?  15 seconds?  30 seconds?

I think it'd need to be "doesn't notice operationally when running the 
virtualized Windows install".

Anyone going through all the trouble to virtualize an existing install 
could probably arrange to have the target computer do the conversion at 
a time when nobody is likely to be around.

Chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/