OSNews

Icaria,

"The benefit is that when Windows is inevitably compromised by a piece of malware, the malware can't write itself to the boot sector."

Not to poke fun at you, I think we're on the same page, but this type of attack is so last century it's barely even relevant to today's malware industry. What would a cracker, who has successfully compromised the machine, want to do with a user's boot sector?

I believe the actual secret goal is to pre-emptively strike against windows-8 mods/jailbreakers deliberately installed by owners to bypass the walled garden microsoft intends to sell to customers.

Install the malware to it, bootstrapping Windows, permitting very low-level access and making it extra difficult to detect and remove. Some malware already does this.

http://threatpost.com/en_us/blogs/symantec-boot-sector-malware-vogu...
http://en.wikipedia.org/wiki/Rootkit#Bootkits

That said, it's not a major problem and I have no doubt it's partially a convenient excuse for MS to wrest more control over the systems running their software.

Edited 2011-09-24 08:27 UTC

Who cares if it can write itself in another critical system service ?

The benefit is that when Windows is inevitably compromised by a piece of malware, the malware can't write itself to the boot sector. "

OK, you do realize that once the OS is compromised, nothing stops the malware from deactivating the signature check mechanism and installing a key logger as a signed update or even throw in a modified kernel image while they are at it, right? Once a software gains "root/admin" *user* access to the system, this is end game for *any* security mechanism. (Even SELinux in strict mode can be circumvented given sufficiently determined attacker).
*Even* if Microsoft goes the extra mile (and they are most likely thinking about it) and disable installation of legacy applications and/or any applications that are not downloaded from MS Market - this still will be useless against OS vulnerabilities.

Walled garden, nothing more, nothing less.

- Gilboa

Edited 2011-09-24 20:26 UTC

Well that's not actually accurate. This isn't like BIOS, where you can run a desktop application in Windows to update your BIOS image. Windows, regardless of the runlevel, has no direct access to the UEFI image.

Thanks for the reply!

Is this really a big risk these days? Seems more like a DOS-era attack.

Does it actually prevent a write to the boot sector, or it just the case that the boot sector must be "signed" and therefore unauthorised boot sector code cannot be executed? (Got a link is really what I'm asking.)

The latter and no.