Re: [GIT PULL] Load keys from signed PE binaries

Theodore Ts'o
2013-02-27T18:00:00Z

On Wed, Feb 27, 2013 at 11:36:09AM -0600, Chris Friesen wrote:
> ...
> At this point you've got a running infected Win8 install that is
> running on Secure Boot hardware but is actually running malware.
>
> Admittedly this would be tricky to do reliably in a way that the
> user doesn't notice, so it may not actually be a real-world threat.

That's another thing which is extraordinarily vague. What counts as
"user doesn't notice"? If a whole bunch of kernel messages scroll by,
is that enough? What if a Penguin jpg shows up for a minimum 5
seconds? 15 seconds? 30 seconds?

- Ted