Pat

reddit.com/r/sysadmin/comments/1kghmst/…?

@Basj I'm glad you can corroborate my findings.

@Basj github.com/ventoy/PXE/issues/106 the pictures on the post at github point to the pictures on the question here, I hope they do not erase it.

@Basj, I repeat I analyzed "iVentoy" and every word I wrote here can be verified, I have provided the decrypting script, then you can get iventoy.dat and obtain iventoy.dat.xz.I have also provided the decompiler snippets showing what they do. I'll try to put it somewhere else.

@schroeder Yes it is a security question: I might be an idiot and someone here might tell me that my concerns make no sense because X or Y.

@Basj I specifically analyzed iVentoy that is the PXE tool and they do what I just described: they do manipulate, they inject, they install falsely signed kernel drivers, they install false self signed root certificates. Ventoy is made by the same people that made iVentoy, it is the USB project doing similar things, I did not analyze Ventoy yet

@schroeder Non-optimal? Microsoft has a huge Windows kernel driver signing procedure in place when at the same time they are hosting the tools on Github for falsely sign kernel drivers? and that cannot be answered or talked in this community?

bootmgr.exe is a signed application able to check its consistency, the BCD consistency and the BOOT.wim consistency before to deploy Install.wim. at this point bootmgr.exe is not using PXE resources at all in order to deploy Install.wim. It is bootmgr.exe responsibility to check its functionality and that its retrieved elements were not tampered.

yes you are misunderstanding my answer; when an "NBP" gets to "deploys" an image it never does it using PXE; i.e. NBP pxeboot.n12 chainloads into bootmgr.exe and this file TFTP transfer a BCD and a BOOT.wim;

Then blaming PXE because some upper layer app mistakenly restores an altered OS image makes no sense.

I hope you can see the difference between both

a PXE environment "finishes its job" as soon as the NBP stops using the PXE APIs offered by the NIC PXE ROM extension (or the UEFI layer in UEFI hardware.

"Network Based Provisioning Environment" is the one that starting with a booting target is able to net deliver and run a software assembly w/o requiring more than a PXE enabled network card.

You can "use" a "Network Based Provisioning Environment" to boot an small OS executive image (i.e. WindowsPE) which includes a single-use applications like an emergency virus scanner.

ok then just get this concept clear. "PXE" and a "Network Based Provisioning Environment" are two different things. I think the title of your question is wrong.

coming down to your case in a 5 man company you sure do not have any potential threat compromising your PXE environment. This is the point your security assessment is wrong because you 1) do not set the boundaries correctly 2) do not dimension the threats according to your environment

PXE is a part of the provisioning equation, we have to be very caution when we talk about the security of the provisioning equation or the security of PXE they are different things

RikuXan, I see your point but the whole thread somehow supports the idea that PXE is insecure when some of the participants do not handle the topic well. Mark's answer is wrong, he doesn't know how DHCP rogue detection works, etc. Ryan's answer clearly blames PXE for an altered image in a PXE restore process when it is the restore application and no PXE the one that has to check the image's integrity.

@RikuXan 1) PXE does not have its own boundaries that's why it is not good considering as a "protocol". 2) is BIS optional? of course; a password in a windows account is also optional. 3) Ryan Gooler answer is "highly imaginative"; he talks about a manipulated image in a PXE restored machine; well that's not PXE's fault at all. I think we struggle here to see where PXE begins and where it ends. I encourage you guys to read about PXE before talking about its security.

@RikuXan 1) PXE is an assembly of protocols; it is not a protocol. 2) why do you need to encrypt an NBP transfer?? do you need to check NBP integrity? then you can use the old Intel's "Boot Integrity Services" specification which is supported by PXE v2.1 or you can use "Secure boot" in today's UEFI world. If you want secure PXE you get secure PXE.

@RikuXan please understand PXE is not really a "protocol" it is an "environment" then its security depends on 1) the security inherited from the underlying protocols 2) by how smart we implement the PXE environment. Well implemented PXE environments are very secure.

@Mark sorry but you are wrong; there's not an "active" way to look for DHCP rogues; DHCP rogue detections just "listen" for offers coming from not authorized DHCP servers. a PXE DHCP server listening for rogues can immediately stop its service and trigger an alarm when one a no authorized DHCP offer is detected.

This answer is not correct. a rogue DHCP can be detected in a manner of seconds, PXE authentication can be granted by DHCP MAC address and architecture; alarm of duplicated MAC addresses can also be easily triggered. PXE security can be easily improved just taking care of it. Today WDS/MDT/SSCM are mostly PXE based and are widely used in a corporate environment

@OliverSalzburg go and try to face your mirror...

@OliverSalzburg neither....

@allquixotic please guys, I'm good with numbers... that's why the upvoting/downvoting is keep "secret"...

@OliverSalzburg then you are either, naive, blind or lying...

@OliverSalzburg do you have any doubt moderators massively upvote each other??????? you know how many times I have seen idiotic answers massively upvoted????

@OliverSalzburg define your goals... can you?? of course it's not providing information...

@OliverSalzburg no way, That's not true, after the cleansing of my answers, several questions were left w/o answer and you guys do not care... this is a business and you guys are just enthusiastic free manpower...

@OliverSalzburg and what that does suppose to mean???

@OliverSalzburg do you thing that downvoting anonymously is fair? do you think that edition changing the meaning and essence of answers is OK? do you think that the moderators can happily upvote each other w/o any problem is ok? no way...

@OliverSalzburg I have been doing that many times before, I just got massively downvoted even on accepted and upvoted answers just a vendetta.. no guys..

@OliverSalzburg community?? I have been treated like sh** here and you talk about what??

@OliverSalzburg WRONG, for you guys this site rules are more important than God itself... and of course they were made on the go, they are many contradictory, many times abusive, etc etc... and the worst part is how comfortable you guys feel about that...

@OliverSalzburg no man, I'm talking that you guys have your rules, this site rules, your group unwritten rules, over any form of common sense available...

@tombull89 I will not talk to you, just give up. I just have censored you

@OliverSalzburg when the rule goes over the common sense you might become an animal if you blindly just follow rules...

@OliverSalzburg do not insult me, I'm not a troll, you have my website, my blog, everything, just take what you have to take (if you are able to)

@OliverSalzburg you wrong, is not just an environment thing, you genetic assets play a very important role, probably not in your case. Peer pressure here is the rule... you guys do not act like individuals; you guys act like a pack...

@OliverSalzburg definatelly

@OliverSalzburg some people cannot see what they really are; sometimes is very sad... it takes acceptance... no so easy in your case...

@OliverSalzburg you have them open, you are just not seeing, watching and seeing are two different things...

@OliverSalzburg you are unable to give an answer... I think you have some power issues... bald young, you like power of banning people, censorship, the perfect profile for a moderator here... but it seems you cannot see it...

@slhck shog... we have some issues with that guy or gal...

@OliverSalzburg don't go around... tell us what you see...

@OliverSalzburg be honest ... tell us the truth... what do you see???

@allquixotic if he's all of that whay he does not answer and just ban people???

@OliverSalzburg just tell us what you see...