6

Some ransomwares, like PETYA, are encrypting the MBR and asking for a ransom. I don’t understand why Secure Boot isn’t preventing that of happening.

Improve this question

2 Answers 2

Reset to default
6

Secure Boot prevents the computer from booting if the bootloader (stored in the MBR, on MBR disks) or other boot-time code is tampered with. It doesn't actually prevent such tampering itself. The purpose of Secure Boot is to prevent malicious boot code from compromising your computer invisibly - think spyware that records your keystrokes and files - not to protect you from malware that tries to deny you access to your computer.

In InfoSec terms, Secure Boot provides integrity - you know if something has been tampered with - and can also provide authentication (if you only trust one signing key, you can be pretty sure that if your computer boots its boot image was signed by that key). It does not provide availability (protection against denial-of-service attacks, which is basically what ransomware is) or authorization (access control checks that control what software is allowed to do) except in the sense that it prevents the machine from booting if the boot image is tampered with.

You can usually block writes to the MBR from the firmware (BIOS or (U)EFI).

Improve this answer
2
  • So, at boot, you should got a secure boot error if infected by PETYA instead of the malware running, is that correct ?
    – paulgreg
    Commented Jan 11, 2017 at 9:42
  • Yes. This could actually make it hard to unlock your machine unless you turn Secure Boot off (or just re-image the HDD and reinstall a trusted OS, but then you lose all your data, of course).
    – CBHacking
    Commented Jan 11, 2017 at 9:46
0

SecureBoot do protect against tampering the boot code. This is what Microsoft writes in its blog:

UEFI Secure Boot is the security standard that uses hardware features to protect boot process and firmware against tampering. This protection will stop the dangerous disk encryption executed by Petya with a bootloader. After Petya’s forced reboot, a machine with Secure Boot will detect the anomalous bootloader and prevent further execution, containing the damage and preventing the very dangerous encryption of disk sectors leading to a complete loss of data.

Further in this blog in the boot recovery options MS clearly describes sample message that is showed to user after such prevention and gives recommendation to use startup recovery for that.

enter image description here

So, probably chosen answer is not technically correct, or was intended to latest (unrecoverable) Petya modifications.

Improve this answer
3
  • This is in fact exactly what the accepted answer described, but in clearer terms than the blog does.
    – Xander
    Commented Jul 12, 2017 at 15:12
  • I don't think so. The @CBHacker insists that SecureBoot only prevents booting (his quote It doesn't actually prevent such tampering itself), but the blog clearly states that SB prevents tampering.
    – Suncatcher
    Commented Jul 12, 2017 at 15:17
  • 1
    It really doesn't...This piece of the quote is key: "After Petya’s forced reboot, a machine with Secure Boot will detect the anomalous bootloader and prevent further execution, containing the damage"
    – Xander
    Commented Jul 12, 2017 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .