|
|
|
|
|
|
by cogman10
2 days ago
|
|
|
> were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services. While I don't doubt that's a motivation, the problem I have is it's really a question of likelihood. I feel that in terms of security focus it's very common for people to put on blinders and ignore the likelihood of an exploit in favor of "Ooooh look at this thing that COULD be exploited!" It's fundamentally the problem I have with how CVEs are reported and handled in general. In terms of secure boot stopping problems. Yes, it does stop someone from rooting a device which is great. However, someone that has access to root a device almost certainly also has the ability to just install a virus in the OS startup scripts. Or to modify a user executable. Or to modify the user's PATH environment variable to inject a malicious app in front of a commonly used one. That's what I wish security focused people would weigh more heavily when they evaluate these sorts of threats. "What other damage could a malicious individual do if they had the same permissions to pull off this exploit." |
|
|
Yes, its more like a popularity contest.
But secure boot stopped(or stops) a whole bunch of driver/rootkit exploits, which was a big thing in the late 2000s. It means that a random driver that is inserted by some script kiddie raises a whole bunch of warnings, which it wouldnt have done before.
We have come a long way since windows 2000