Secure Boot - Verifying applications

Question

I have been reading up on Secure Boot, in particular what it actually checks during the boot process.

According to Microsoft the Secure Boot process works as follows:

1. Firmware Boot Components: The firmware verifies the OS loader is trusted

2. Windows boot components: BootMgr, WinLoad, Windows Kernel Startup. Windows boot components verify the signature on each component. Any non-trusted components will not be loaded and instead will trigger Secure Boot remediation.

   Antivirus and Antimalware Software initialization: This software is checked for a special signature issued by Microsoft verifying that it is a trusted boot critical driver, and will launch early in the boot process.

   Boot Critical Driver initialization: The signatures on all Boot-critical drivers are checked as part of Secure Boot verification in WinLoad.

3. Additional OS Initialization

4. Windows Logon Screen

From this I have understood that Secure Boot will only check the firmware (bootloader, EFI applications, OS integrity).

But would it be possible to have the secure boot process also verify the integrity of the OS applications from tampering as well? I.e some user applications that run on Windows e.g paint etc.

If you do the whole signing process of a user application you want to have its integrity checked, and add it's public key to the Secure Boot whitelist database, would it actually check the user application's integrity? I searched online but I could not find a definite list of what exactly Secure Boot checks for.

Answer 1

UEFI firmware launches the Windows bootloader when it has been correctly verified (it's been signed by one of the entities your firmware trusts). Once on the Win bootstrap, there is a module that verifies code integrity of every module in the kernel. All the drivers/modules that are not signed or signed by an entity not included in the code integrity db are simply rejected and the boot process will fail warning the end-user.

Now, you can override that policy to even load unsigned drivers. OK, but what about user delivered apps/programs? Well there exists something called code integrity where a developer signs his software including a timestamp, so if the certificate expires somehow, that timestamp validates the signature. It's a security matter that entirely depends on you, you are exposing yourself installing unverifiable software, so be sure that the source is reliable when code signing is not included.

I'm not an active Win user right now but I'd say that most of the shipped software included in any modern Windows OS is directly signed by Microsoft following the code integrity specs. Look also for signature catalogs, it's very instructive. Now, if you were a Linux user, software downloaded from official repos is guaranteed to be signed so signatures can be validated with pgp keys of the repo, there have been cases of compromising the official repositories, so danger it's still out here for us all.

Answer 2

This article says that secure boot exists because of the threat of bootkits and rootkits. Once the OS is running, then the antivirus software can take over and check the applications running on the system. It seems to me that, for good user experience, Windows wants the boot process to be secure and fast. To this end, it checks what's necessary for secure boot and no more, leaving OS applications to the antivirus.

I'm definitely not an expert on secure boot, though, so I freely admit I could be mistaken on this.