Re: [GIT PULL] Load keys from signed PE binaries

Chris Friesen
2013-02-27T19:21:59Z

On 02/27/2013 11:59 AM, Theodore Ts'o wrote:
> On Wed, Feb 27, 2013 at 11:36:09AM -0600, Chris Friesen wrote:
>> ...
>> At this point you've got a running infected Win8 install that is
>> running on Secure Boot hardware but is actually running malware.
>>
>> Admittedly this would be tricky to do reliably in a way that the
>> user doesn't notice, so it may not actually be a real-world threat.
>
> That's another thing which is extraordinarily vague. What counts as
> "user doesn't notice"? If a whole bunch of kernel messages scroll by,
> is that enough? What if a Penguin jpg shows up for a minimum 5
> seconds? 15 seconds? 30 seconds?

I think it'd need to be "doesn't notice operationally when running the
virtualized Windows install".

Anyone going through all the trouble to virtualize an existing install
could probably arrange to have the target computer do the conversion at
a time when nobody is likely to be around.

Chris