Badge technology blog

Why the Windows 8 UEFI secure boot thing has me worried

Windows 8 Unified Extensible Firmware Interface secure boot requirement doesn't portend the arrival of the Four Horsemen, but it does suggest they're logged onto Expedia and are planning the trip
Microsoft's 'secure boot' wll make Windows 8 tougher to break into. Photograph: Eloy Alonso/Reuters

When I was nine, I remember sitting in the back garden of my house when two of my friends popped around. Around me were various bits of timber, a torch and a sheet of Perspex. When they asked me what I was doing I told them, matter of factly, that I was making a photocopier.

The inspiration from the idea came from a lesson in school where we had been given some photographic paper and some leaves and shown how to expose the paper to create an inverse picture of one or more carefully arranged leaves. My nine-year-old brain surmised that this was exactly the right technology upon which to base a homemade photocopier. This was important as, at the time, I didn't have a photocopier readily available to me.

Ignoring the obvious question of "why does a nine-year-old boy want a photocopier", I'm presenting this story in the hope that some of you out there can reflect on similar experiences. For example, like me, you may also have tried to build a heads-up display for your first car (and failed), or tried to make a light-up nose for Red Nose Day (and failed), or tried to build an answering machine (and failed).

But I have over my time had far more luck tinkering with software, even during the period where I was failing to trouble Rank Xerox with my R&D skills. The point is this – geeks are born young, and this article looks at the needs of young geeks in the context of UEFI secure-boot and the commoditisation of personal computing.

So what is Unified Extensible Firmware Interface and secure boot?

UEFI is designed to replace the old-school BIOS subsystem that can be found in every computer. (The BIOS is used to prepare the ground for loading the full-on operating system that you might have installed on your computer – eg, Linux, Mac OS X, Windows or a mixture.)

UEFI is not a particularly new idea. Like everything in our industry, things change, evolve and improve and UEFI looks to fill in some gaps and make the pre-OS environment more flexible, maintainable and manageable. Why it's become relevant in the press recently is that Microsoft has stated that in order to get certification (ie, a logo) for any boxes shipped with Windows 8 pre-installed, a feature called "secure boot" has to be enabled.

Secure boot is designed to stop malware shoving itself into memory before the OS proper starts to load. If malware is able to insert itself in before the operating itself loads it can circumvent and avoid any malware countermeasures that happen to be installed in the machine. Malware that works in this way is particularly evil – you would have to be a specialist in your field to even find it.

Secure boot works on classic code signing principles. The Windows 8 boot loader will be signed, and burned into the UEFI chipset will come a list of valid public keys. If your boot loader is signed with a private key that matches one of the burned in keys, away you go. If not, you will be locked out. (The Build Day 1 keynote has a demonstration of this feature, one hour and nine minutes in.)

Because we know that the Windows boot loader has got in first, we know for certain that malware countermeasures can be properly loaded. A whole class of malware is then knocked off of the Windows 8 platform.

That sounds wonderful! Where's the beef?

The problem with this arrangement is that it ties a machine that once had Windows 8 on it in such a way that it can only run Windows 8, Windows 9, Windows 10 and so on. If you want to install Linux on it, or create a Hackintosh, or make up your own operating system with secure boot enabled, your boot will fail.

For reference, there's capability for extending this such that one could be prevented from installing Windows 8 Server onto a machine that was provided with a desktop-class version of Windows 8.

The operative phrase in all of this is "secure boot enabled". The obvious answer is "turn off secure boot". This would then mean that you could wipe the machine and install Linux or anything else that you fancied to install.

Two points for completeness:

Firstly, "why can't Linux be changed to include secure boot" is hugely complicated and beyond the scope of this argument. It's all to do with the fact that the private key implementation essentially requires a closed source, proprietary operating system like Windows and not an open OS like Linux. (There's a good write-up on ARS Technical.)

Secondly, there is an – what to me is a frankly thin – argument that the motherboard manufacturers won't include the switch to turn secure boot off in the UEFI settings. This just isn't the style of how these guys build motherboards – if you think about it, people who build motherboards are the geekiest of the geek, they love switches and there's no current commercial motivation for them to disable the switch.

Plus having a split where some motherboards have the switch and others don't would create a split and additional complexity in the supply chain. The motivation of the supply chain tends towards simplification.

Microsoft has been playing this issue down (notably in this blogpost), essentially saying it doesn't care if other people use secure boot or not – it just wants a better experience for their customers.

The Horsemen are coming!

Of course, they are not, but this is the sort of public spat that has the makings of a perfect storm in Geeksville – evil Microsoft trying to force motherboard makers into a decapitation attack against Linux. Not going to happen – as I suggest, Microsoft doesn't care about Linux. It even sent Linux a birthday card.

The Horsemen are, however, packing for the trip!

It's this whole thing, in combination with the iPad and Apple's resurgence into the personal computing market, that has me worried.

I bought my iPad shortly after they were first announced – during that period when no one really knew what they were going to be used for. I only bought it our of curiosity because it's my job to understand how things work.

When I started using it I realised the brilliance of it, but it's the only computing device I've ever owned that I've never tried to mess around with. I turned it on, I started to use it and I've never looked into it in any deeper sense.

But I have looked forward and I'm rooting for Android and Windows 8 to produce iPad clones – not because I think there's anything wrong with what the iPad does, but because of what it says about our industry.

I don't want to be in an industry where the only thing like an iPad is an iPad because – as we'll come onto – I have some problems with the way that Apple operates.

For my day-to-day work, I own and use a MacBook Pro. It is probably the only piece of computer hardware that I have ever owned that I am a little bit fearful of.

With a Windows machine, I always have a strong sense that I'm in the one in charge – than should shenanigans occur the thing will eventually bend to my Alpha Dog will. With my Mac, I've never been confident which side of the power battle I'm actually on. Likewise with my iPad – it's in charge of the job it does for me and I'm just going along for the ride.

The problem with Apple is that the machines they make are reductive, Fisher Price-style, "push button – receive pellet" computing. I bought my wife's iPad entirely on that basis.

I knew giving her an iPad to use was going to yield absolutely zero problems, whereas an Android tablet was going to result in constant stream of problems you get with non-Apple products.

You see, the genius of Apple is that it creates reductive, Fisher Price-style, "push button – receive pellet" computing and if you're not a hardcore geek hacker, this is exactly what you want. "Push button – receive email", "Push button – receive email", "Push button – it turns on because the battery life is so ridiculously good".

(As a sidenote, I've always found it somewhat strange that a decent sized contingent of Mac users are seriously talented hackers who eschew Windows because it's not open, but flock to OS X because it is and seem to be able to make peace with the fact that their supplier is anything but open.)

Apple's approach is reductive in the sense that it reduces complexity down to a common denominator, but its skill lies in making that denominator high enough to create an interesting piece of kit.

Look at an iPad's basic feature set and you'll find essentially nothing – there's not even a "clock" application. Go back to the turn of the century and you'll find the iPod. It was only a few years before that I remember to rip a CD involved one application to rip it to WAV format and another to transform it into MP3. That later conversion process used to run overnight.

With iPod and the iTunes Music Store, Apple reduced down complexity of that whole thing down to – guess what – "push buy button on iMS – receive delicious musical pellet". And thus the iPod was a success because it was technology that did not get in the way.

We've all been at the end of the phone trying to help a relative achieve what, to us, is a straightforward computing task. We need software to be simpler for them not just for us but so that they can be connected with the data that they need in shorter order and with less frustration.

Users need to interact with computers in a "push button – receive pellet" manner, but for us to do that we paradoxically need a computing environment and industry that provides for the total opposite to that, which in my head runs like: build factory to make pellet, handle ERP functions for pellet manufacturer, run global logistics network to deliver pellet, etc.

Why the UEFI Windows 8 Secure Boot thing has me worried is because actually, we've come pretty close to a decapitation attack on Linux where motherboard manufacturers either build mobos that can run Windows 8, or Apple commission custom-made kit to run OS X. It's only Microsoft's lack of interest that's kept Linux on the table. Go back a few years when Microsoft was still worried about Linux on the desktop and a little more arrogant and this story could have been pretty different.

Hacking around

It's commoditisation of the personal computing market that is driving us towards a place where the devices that are delivered to us are locked down and sealed. iOS is unbelievably locked down, but its success shows the industry that if you lock down the OS and curate the marketplace for delivering apps to it, your malware horror story count goes to zero and your customer satisfaction increases inversely.

Android, for example, has horror stories virtually every day – albeit few of them malicious. Microsoft and Apple are likely to tend towards the iOS "lock and curate" model for their desktop efforts as well.

Applying "lock and curate" universally and preventing new OSes from being invented is going to cause stagnation in innovation, while providing the important benefits of increasing end-user security.

I would imagine that all of you reading who know HTML learnt it by viewing the source of interesting pages. If today we want to learn how a Web 2.0 website's ajax calls are working we'll take a look at the traffic and see what's happening.

None of us is looking to do any harm, but we all learn by doing and the best way to learn in the field of software engineering is to examine, copy and repurpose. Now consider the structure of Metro apps on Windows 8 – familiar technology, and yes you can watch the network traffic, but you cannot readily take it apart as you can a regular HTML application.

We are tending towards less visibility of the underlying mechanisms of application construction. For the 12-year-old wannabe coder in his bedroom, this isn't good news. He's got a lot on his mind – this has to be pretty easy to keep him interested and get the momentum going.

No one that we look up to in the software engineering community was created and grown in a lab in academia and decanted into the world, fully formed and able to hack rings around us. All the people that we admire and respect for their programming chops all learnt because rather than being out with their friends driving their BMXs into trees at full pelt to see who could get the best scars they were poring over some output or tweaking some code. Really good coders start young.

Case in point – where would we be now if Linus Torvalds wasn't able to create his own operating system at the age of 22? Personally, if I come home from work one day and find that my children have formatted every machine in the house to make way for a home-grown supercomputing cluster – well, let's just say they'll find an extra 20p in their pocket money that week.


We as engineers need to be able to take things apart and, much like as a child I was forever taking things apart – although as a pretty talentless physical engineer "taking things apart" was euphemism for "disassemble before landfill".

As software engineers we need to be able to sniff packets, view source and disassemble code. If we can't do that, we can't learn. Importantly, if our kids aren't allowed to do that because commoditisation has created an environment that is too reductive, the next generation will be pretty crappy engineers.


Today's best video