1

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my wallets data in any way even if they have keyloggers. Also games require full performance. The only way I see to achieve this is to have 2 Windows installations in my boot configuration:

  1. Unencrypted Windows for games
  2. Encrypted Windows with cryptowallets

The security issue here is that apps running in unencrypted windows can alter VC boot loader to get my password. Is there a way to prevent it? Are there any other issues?

I know about cold storage wallets, please don't suggest them.

4
  • Install Windows on an external drive (Windows 2Go), for instance. This way the game-mode Windows don't even know there's another installation. Performance won't be great, but it works.
    – ThoriumBR
    Commented Dec 31, 2023 at 22:35
  • Interesting solution. So the encrypted one can be on a portable SSD. And I should set USB as a 1st boot priority. When I need to boot the gaming Windows, I can just unplug that SSD. Unless something on the gaming Windows messes BIOS firmware, it is secure. Which I can't control, can I? @ThoriumBR
    – Vlad
    Commented Jan 1 at 10:07
  • If you are worried about a sophisticated malware messing with the BIOS and the loss from the crypto wallets are larger than the cost of a low-end computer, buy another computer.
    – ThoriumBR
    Commented Jan 1 at 12:54
  • @ThoriumBR I guess cold storage wallet is cheaper than a computer
    – Vlad
    Commented Jan 10 at 0:59

2 Answers 2

0

The security issue here is that apps running in unencrypted windows can alter VC boot loader to get my password. Is there a way to prevent it? Are there any other issues?

With Secure Boot on (any x86-64 computer built in the last 10 years) this won't/can't be happening.

https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/trusted-boot

Secure Boot has been hacked recently, so it's on you to keep your BIOS and your Windows installation up to date.

https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/

TBO I don't even like the idea of having potential malware co-existing with your secure Windows installation. If I were in this situation, I'd have two physical disk drives and switched between then when necessary.

2
  • Switching SATA or M2 disks inside PC is not that easy. Doing that with notebook every time is unreal.
    – Vlad
    Commented Jan 10 at 0:56
  • For Secure Boot, it must allow VeraCrypt boot loader. If that boot loader can be added to the trusted list, what prevents another app with admin privileges to register its own malicious boot loader the same way?
    – Vlad
    Commented Jan 10 at 0:57
0

Windows nowadays has several features to protect the boot process

Secure Boot. PCs with UEFI firmware and a Trusted Platform Module (TPM) can be configured to load only trusted OS bootloaders.

Trusted Boot. Windows checks the integrity of every component of the startup process before loading it.

Early Launch Anti-Malware (ELAM). ELAM tests all drivers before they load and prevents unapproved drivers from loading.

Measured Boot. The PC's firmware logs the boot process, and Windows can send it to a trusted server that can objectively assess the PC's health.


You could also consider creating a vm for your crypto wallets and run all the crypto things in that VM, and run your games directly. You can also harden and secure that crypto vm then with some hardening benchmarks

2
  • 1
    For Secure Boot, it must allow VeraCrypt boot loader. If that boot loader can be added to the trusted list, what prevents another app with admin privileges to register its own malicious boot loader the same way? Does VeraCrypt bootloader have the same integrity self-checks?
    – Vlad
    Commented Jan 10 at 0:47
  • 1
    VM inside a possibly-infected host is not secure in any way. The host can keylog virtual disk encryption passwords and access wallets data.
    – Vlad
    Commented Jan 10 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .