Why would you need UEFI if 64 bit system is suppose to protect

[groze]

Why would you need UEFI if 64 bit system is suppose to protect you from the rootkits? I have been doing some reading about UEFI it is confusing, a few sites say ignore what you read on other sites.

Wouldn't 3rd party backup software fail with UEFI enabled?

I read Ubuntu and other Linux system are starting to support UEFI & GPT just not secure boot-yet. I am not a linux fan but I do like LUbuntu with Xfce4 desktop installed. I just don't like entering password constantly.

 

[LMiller7]

When 64 bit systems were first introduced they were relatively safe from Rootkits. But as they gained market share rootkit authors began to target them. There are now 64 bit rootkits and more are expected in the future.

UEFI systems offer a number of advantages over BIOS systems which they will eventually replace. It isn't just about security.

 

[3D Jed]

Call me cynical*, but I thought the whole idea of UEFI was to prevent the well-known piracy MBR hack that has cost Microsoft billions. The hack is located in the MBR, and mimics OEM SLP activation. Since it loads before Windows it cannot be detected or prevented (although can be easily seen in a MGADiag report). The only fix is a hardware one - UEFI secure boot.

*cynical - adjective - 'believing that people are motivated purely by self-interest; distrustful of human sincerity or integrity'

 

[groze]

3d Jed, UEFI is not only used by Microsoft, it is used by other operating systems including Apple, Linux, BSD, etc. Secure boot is separate feature.

If I understanding what I have read & What Lmiller 7 said
UEFI with Secure boot enabled is the safest but usually can't install other operating systems. UEFI without Secure Boot is 2nd and you can usually install other operating systems that support UEFI

There are a couple of 32 bit systems that support UEFI don't know if it is with or without Secure boot.

I don't think windows 7 64 bit supports secure boot but supports UEFI, I am quite not sure on that.

 

[LMiller7]

UEFI wasn't implemented for any one reason.

The BIOS system used in many modern computers is descended from that used in the original IBM PC released in 1981. And that was closely based on that used by the 8 bit CPM operating system of the 1970's. It's primary purpose was to provide a hardware independent interface for the operating system and to initiate the boot process. A secondary function was to manage the initial hardware configuration of the system.

The BIOS system worked quite well for the hardware and operating systems it was designed for. It served us well for many years. But a great deal has changed since then. Modern operating systems use the BIOS functions only in the very early stages of the boot process. The functions provided by the BIOS are hopelessly inadequate for the requirements of any modern OS. Once loaded the OS doesn't use the BIOS at all. The ability of the BIOS to perform it's other roles are limited by the basic concepts of it's design.

UEFI was designed to replace the old BIOS system and to avoid it's many technical limitations. Security was just one of many reasons.

Note that I am by no means an expert with UEFI and in fact know very little about it.

 

[3D Jed]

3d Jed, UEFI is not only used by Microsoft, it is used by other operating systems including Apple, Linux, BSD, etc. Secure boot is separate feature.

I could post links to the MBR piracy hack, and you could try it out in a VM, and see what I'm talking about, but forum rules forbid (for obvious reasons). I've tested the MBR hack in a W7 VM and it works. MS have lost billions due to this. IMHO all this UEFI malarkey is about MS and piracy.

 

[logicearth]

IMHO all this UEFI malarkey is about MS and piracy.

No it is not. UEFI started long before Microsoft and the SLIC Bios hacks. UEFI brought several technical advantages with it, for example, hard drives larger then 2TB were supported for booting with thanks to GPT just one example.

Either way Microsoft is not the one pushing UEFI, hardware manufacturers are. Almost all new motherboards and OEM system builders are UEFI now. This was happening well before Microsoft had any incentive.

Not that it matters, if this was about piracy as proclaimed, Microsoft would stop one from installing on older BIOS based systems. But nope, go ahead install away. Heck, can turn off UEFI and emulate an old BIOS system all most UEFI systems.

 

[3D Jed]

dude - you don't understand

MBR hack works and has cost MS billions

when all BIOS is UEFI the above hack won't work

 

[logicearth]

I understand perfectly fine. But there is nothing stopping those hacks from working on UEFI based systems. After all, UEFI supports booting MBR as well as other things. What changed is Microsoft altered the way SLIC work in Windows 8 by removing universal OEM keys.

The problem with understanding is you, however. You are so focused on your own single point of view.

 

[3D Jed]

The loader I'm referring to resides in MBR and can't be used with GPT. You say 'UEFI supports booting MBR as well as other things' - maybe I don't understand UEFI, but isn't 'UEFI with MBR' just MBR with a groovy interface that has mouse support + graphics. IMHO eventually MBR support will end (and so will MBR piracy).

Quote from the FAQ for the loader that the pirates use -

'The loader doesn't work when the systems using GPT. The workaround is to pre-format your hard drive so that it uses MBR instead.'

anyone who's come up against probs downgrading Windows 8 to 7 will know all about locked down BIOS and locked HDDs. That's the MS/UEFI way to solve their piracy problem.

Report: China's software piracy rate falls to new low -- of 77% | ZDNet

this discussion is getting a bit close to the forum rules re: piracy, so I'm outta here . . .

 

[logicearth]

3d Jedi, I think you are mixing things up. MBR has nothing to do with UEFI. MBR is a hard drive partitioning scheme. Having a UEFI motherboard does not remove support for MBR.

 

[NoN]

3d Jedi, I think you are mixing things up. MBR has nothing to do with UEFI. MBR is a hard drive partitioning scheme. Having a UEFI motherboard does not remove support for MBR.

UEFI enabled Board and Bios settings can be set to UEFI secure boot but you still can choose an install of your operating system to Legacy Boot or UEFI Boot, which last one will remove the MBR support to the prefered GPT scheme. New Bios must have bynow the UEFI secure boot enable along the CSM enabled or not, by default because of new coming OSes started by Windows 8.

 

[logicearth]

New Bios must have bynow the UEFI secure boot enable along the CSM enabled or not, by default because of new coming OSes started by Windows 8.

That is only for OEMs that want a "Windows 8" sticker legitimately slapped on their hardware. Even then Secure Boot is optional.

 

[gregrocker]

UEFI BIOS vs. Legacy BIOS - YouTube

UEFI (Unified Extensible Firmware Interface) - Install Windows 7 with - Windows 7 Forums

Bypass UEFI to Install WIn7 to Legacy MBR

 

[NoN]

New Bios must have bynow the UEFI secure boot enable along the CSM enabled or not, by default because of new coming OSes started by Windows 8.

That is only for OEMs that want a "Windows 8" sticker legitimately slapped on their hardware. Even then Secure Boot is optional.

Last Bios versions of my motherboard have set to default the UEFI Mode & secure boot to enable...CSM is disable by default. I'm on retail version of Windows 7.

Since it does not interfere with Legacy boot i have decided to let it as the last Bios provided set it.

 

[gregrocker]

You really only need to enable CSM if you want to install a Legacy OS like Win7. Windows 10 even runs under Secure Boot, although I had to disable it the other day to boot the Macrium Reflect PE disk.

 

[3D Jed]

Mobo's are migrating to GPT/UEFI and when it's 100%, MBR activation hacks will be history. Meanwhile . . . MS has changed the Windows 8 OEM serial mobo malarkey so every system has its own key (thus rendering any MBR hack attempt pointless), but the hackers are already on the case. MS left the door open with KMS volume activation. The hackers now have a tool that emulates volume Windows 8 activation, and it can be set to run at startup, giving a constant 180 days before re-activation required.

cat/mouse etc

 

[NoN]

Just found that...

By policy, Windows 8 and Windows 8.1 require UEFI firmware to boot the operating system. UEFI provides basic services such as access to the boot device in the pre-boot environment. Windows Server and earlier versions of Windows client do not require UEFI mode and can boot either from traditional BIOS or from UEFI if this is supported by firmware. To enable booting these operating systems on a computer that uses UEFI, Compatibility Support Module (CSM) in UEFI provides compatibility support for traditional BIOS. Windows 7 and earlier versions of Windows require INT 10H support for boot graphics. This is provided by CSM in UEFI mode. The CSM can also be used to fully support traditional BIOS mode on a system that has UEFI firmware. These modes are known as Class 2 UEFI mode and Class 2 BIOS mode.

Fully posted here #199: http://www.sevenforums.com/tutorial...rface-install-windows-7-a-20.html#post2924511

 

[groze]

Mobo's are migrating to GPT/UEFI and when it's 100%, MBR activation hacks will be history. Meanwhile . . . MS has changed the Windows 8 OEM serial mobo malarkey so every system has its own key (thus rendering any MBR hack attempt pointless), but the hackers are already on the case. MS left the door open with KMS volume activation. The hackers now have a tool that emulates volume Windows 8 activation, and it can be set to run at startup, giving a constant 180 days before re-activation required.

cat/mouse etc

3d Jed,
If that was the case, I would had to activate my operating system when dell replaced the motherboard, didn't have to do that & it was a vlk. Also, the OEM key on the back of the computer wouldn't have worked to activate windows 7 via the internet, when I did unorthodox reinstall of windows 7 oem without violating the EULA.

 

[groze]

Does Secure Boot or UEFI really protect from malware & rootkits?

Doesn't UEFI with Secure Boot on or off, boot using a fat 32 partition? I thought Fat 32 was insecure?