0

Is it possible to protect my bare-metal from compromise, so that I can be fairly confident that (for example) restoring a VHDX system image every month keeps me clean? If so, how?

I'm building a rather costly new PC. I would like to isolate my development and game environments from firmware as much as possible, especially for security reasons (e.g. bootkits and firmware rootkits). I worry more each day about trusting my required software.

Current configuration:

  • Environments: Game (Steam, Oculus) vs. Development (Visual Studio)
  • Windows 10 Professional, multiple licenses
  • Purchased newly packaged OS installation media to ensure it is clean
  • Running development from a VHDX via Hyper-V
  • Game environment benefits from direct GPU, so less useful via Hyper-V
  • I have Secure Boot enabled
  • System supports TPM, willing to install and enable
  • Not using BitLocker, but willing to

I care less about single-instance vulnerabilities (e.g. compromising one bank account password, or leaching some GPU today) than I do about a long-term issues (e.g. a bootkit that, for the next four years of this PC's life, renders all password changes ineffective, or continually mines cryptocurrency).

The isolation desire is also for mundane performance reasons (e.g. separate SQL Server from Steam downloader), but hawk-like attention to running processes or simply dual-booting addresses that.

A related question, Is dual-booting more secure than having a single operating system installed? , raises but does not solve the long-term threat concern. Additionally, I feel the accepted answer underestimates the value to attackers of compromising a large quantity of unremarkable PCs, and thus underestimates the likelihood of it happening.

|improve this question
  • Secure Boot, and FDE encryption implemented within each virtual operating system, would practically prevent 99% of malicious attacks. You can boot directly to Hyper-V virtual machines by the way. You make no mention of the processor, but to take advantage of booting to a virtual machine and use the hardware attached, you need specific virtualization features. What those features are well documented. Of course, how you protect yourself from rootkit and other malicious software has nothing to do with VMs and Secure Boot, you prevent those through user behavior. – Ramhound Jul 18 '18 at 20:10
  • Thank you Ramhound. I understand (I think) your comment to mean that FDE on Environment-specific (OS/Data) partitions keeps OSes safe from each other, while Secure Boot keeps the pre-OS environment safe, thus covering most disk attack vectors. If so, 1) is TPM necessary for that, and 2) does booting a VHDX create additional vectors? Lastly, I assume my entire system would still be vulnerable to Spectre/Meltdown-like vulnerabilities? – shannon Jul 18 '18 at 20:19
  • Also, I don't mean to be argumentative, but my behavior is already cautious, and I'm saying that I wish to go further. That is the point of my question. I'm looking for solutions to further harden a system from rootkits and other malicious software. It is logically possible for such tools to exist, and so I am asking if they do. – shannon Jul 18 '18 at 20:25
  • Every security action involves a balance between usability and security. If you wish to fully secure your computer you leave it air-gapped from any network, and powered off at the hardware level, but of course that is not useful except for Root Certificate Authorities, where you turn the computer once in a while to refresh authoritative certificates. For a daily-usable computer you have to accept a certain amount of risk. The various methods for securing a computer for normal use are well known, and you just have to accept that they are not perfect. – music2myear Jul 18 '18 at 20:45
  • Thank you music2myear, I understand your comment, and having been an information systems consultant for 25 years am familiar with the unlikeliness of having everything we wish. However, I also know that since I've last studied fundamental Intel compute system security, many technologies related to this topic have been introduced (e.g. UEFI, TXT, SGX, etc.). I think it is fair to say some of those technologies are not well known relative to the audience that would search here (on SuperUser) for information. I hope others are willing to expand on any helpful related solutions to my question. – shannon Jul 18 '18 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.