Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ORWL – The first open source, physically secure computer

crowdsupply.com

Post reply on HN
Print view View original

121–130 of 195 posts

Re: ORWL – The first open source, physically secure computer

#121

Post by Foxboron »

Sanddancer wrote: post #89
brian_herman wrote: post #11

How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/

In order for the Management Engine to really do much, you need to have a network card that the management engine knows how to talk to. If you don't have such a network interface, the ME can't do all that much, and any adverse security risks are near zero. Add to that things like the firmware write line being controlled by a completely separate microcontroller, and the big things that are discussed are completely infe…

According to their documentation, the network module is "Intel Wireless Module". I assume Intel ME know how to talk to this one?

https://www.orwl.org/wiki/images/9/95/SowDESIGN-SHIFTORWLPUB...

Re: ORWL – The first open source, physically secure computer

#122

Post by dogma1138 »

talltower wrote: post #111
startling wrote: post #106

Since the monitor is external, I wonder if they've considered monitors as attack surface: https://github.com/RedBalloonShenanigans/MonitorDarkly

Correction. The temperature monitor is INSIDE the secure shell.

He's talking about display monitors AKA the screens which can be exploited via the i2c bus over the graphical interface (e.g. HDMI).

The GP is 100% correct, if you can't trust your keyboard, mouse, and the monitor the "secure computer" concept in this case is problematic, while it does reduce the attack surface somewhat it just focuses the attention of the adversary onto a different vector.

If we take their "cleaning man/evil maid" scenario then while implanting the computer might not be possible, implanting the keyboard, mouse or screen would be very possible, and in fact somewhat easier than implanting a regular computer with decent security measures such as an encrypted drive.

Add a USB storage device with a micro-controller to the keyboard and you own the computer once it's connected, a monitor today comes with a CPU powerful enough to run custom code which can be used to exfiltrate data as well.

Additionally both the keyboard and the monitor could potentially be used to exploit software flaws on the software running on the ORWL unit also.

The concept is interesting however this is mostly "security theater" any adversary which would be sophisticated enough to require taking these measures would likely be able to circumvent them, and for the rest these measures don't really do anything; if you use this for day to day operations or on-net activity you'll get pwned via the network; if you keep secrets on this thing worthy of sending some one into your home to implant your PC then they'll implant something else which is connected to it.

Oddly enough the only "high tier" adversary that this might thwart would be law enforcement since their computer forensic SOP would pretty much melt down when encountering something which is tamper resistant.

But hey, you gotta start somewhere.

Re: ORWL – The first open source, physically secure computer

#123

Post by uxcn »

grandsham wrote: post #65
dmichulke wrote: post #48

Earlier quoted context omitted.

You have to account for Moore's Law within the few trillions GP mentioned

Bruce Schneier and others[1] have done the math on brute forcing 256 bit keys: even with a perfectly efficient computer using the least amount of energy possible, you would have to deplete the entire energy content of the Sun to just iterate over a 225 bit keyspace once, let alone do anything meaningful with those keys. Moore's Law doesn't really factor into it. [1] http://security.stackexchange.com/a/6149

It's estimated there are 10^80 atoms [1] in the visible universe, so 2^256 is definitely a huge number. I didn't realize 256 bit brute force was nigh feasible with only a solar system.

I'm a bit surprised the quantum algorithm only gives a polynomial speedup.

[1] https://en.wikipedia.org/wiki/Observable_universe#Matter_con...

Re: ORWL – The first open source, physically secure computer

#124

Post by startling »

talltower wrote: post #111
startling wrote: post #106

Since the monitor is external, I wonder if they've considered monitors as attack surface: https://github.com/RedBalloonShenanigans/MonitorDarkly

Correction. The temperature monitor is INSIDE the secure shell.

I do mean display monitor, not temperature monitor.

Re: ORWL – The first open source, physically secure computer

#125

Post by nickpsecurity »

apaprocki wrote: post #99
nickpsecurity wrote: post #88

Earlier quoted context omitted.

Specifically, the OpenSPARC T2: http://www.oracle.com/technetwork/systems/opensparc/openspar... The ASIC implementation was nice: https://en.wikipedia.org/wiki/UltraSPARC_T2 On a 65nm node... very outdated one... it might get 8 threads in 8 cores at 1.6GHz each with hardware RNG, crypto accelerators, and hypervisor support. That's the kind of implementation that would be useless for an open-source, secure workstation…

Sadly the T1/T2 are ancient now. The non-open SPARC is up to T7, which is 20nm process, 256 threads on 32 cores.

Sort of. I run the bloated Web, movies, IDE's, servers, and VM's on a Core Duo with 2 cores under 2GHz done on 65nm. I'd loose some single-threaded performance probably with an OpenSPARC T2 but otherwise it should handle my modern workload. Doesn't quite feel ancient. ;)

The cool thing about open-source CPU's is one can always improve on them to, say, have an extra dozen cores on more recent nodes. Like Oracle does but probably less impressive with less money.

Re: ORWL – The first open source, physically secure computer

#126

Post by mastazi »

na85 wrote: post #119
lallysingh wrote: post #94

Earlier quoted context omitted.

There's no such thing as "secure", and frankly complaining that anything that has better security than regular products shouldn't advertise as such is ridiculous. How else is there any progress when the community's just pulling everyone down with this "it's no good if it isn't completely perfect" crap?

Frankly I'm not sure it is any better than regular products. It still has a backdoor baked in. Keep on downvoting because you disagree, though.

> Frankly I'm not sure it is any better than regular products.

Care to elaborate?

> It still has a backdoor baked in.

True, but this does not explain or validate your previous statement. You are saying: "A has these pros and this con, B has the same con but none of the pros, hence A and B are the same". This sounds like a poor argument to me.

> Keep on downvoting because you disagree, though.

I believe that you are being downvoted because your last two comments are poorly articulated.

Re: ORWL – The first open source, physically secure computer

#127

Post by Johan-bjareholt »

hackermailman wrote: post #85
teaearlgraycold wrote: post #19

Earlier quoted context omitted.

Didn't know about this. They should have gone with AMD.

My Rockchip Chromebook doesn't have proprietary microcode, libreboot supported, costs $200. Only proprietary issue is the 3D acceleration

That is the case with many ARM processors. There is a lot of work being made on iGPUs on ARM processors aswell currently such as freedreno, will hopefully be possible to have a good fully open source experience in a few years with arm linux computers.

Re: ORWL – The first open source, physically secure computer

#128

Post by mastazi »

eeZah7Ux wrote: post #114
Animats wrote: post #68

This appears to be a good solution to the wrong problem. Maybe if they team with someone working on secure computer software...

Kudos to the open source design but they should not encourage users to run windows on it.

The promotional video shows someone using Linux. Do they mention Windows somewhere else on their site?

Re: ORWL – The first open source, physically secure computer

#129

Post by Hello71 »

talltower wrote: post #110
BinaryIdiot wrote: post #107

Now this is really cool! Though as with all things wireless I'd worry about working and somehow the key fob getting interfered with and boom computer locks up or if a sensor thinks I'm moving the computer when it's really just an Earth quake or maybe even my cat jumping on the table and then the encryption key is deleted. So I love the idea but not sure of the practicality. Those sensors has to essentially work perfe…

The SSD encryption key will only be deleted in case of a tamper event, NOT when the unit is moved. Tamper events are: * freezing the unit * drilling the secure enclosure or other wise breaking the traces on it * prying the enclosure off the PCB So I don't think you have to be too worried about a false trigger of a key erasing.

what temperature (approximately) is "freezing" (or less likely, overheating)?

Re: ORWL – The first open source, physically secure computer

#130

Post by Sanddancer »

Foxboron wrote: post #121
Sanddancer wrote: post #89

Earlier quoted context omitted.

In order for the Management Engine to really do much, you need to have a network card that the management engine knows how to talk to. If you don't have such a network interface, the ME can't do all that much, and any adverse security risks are near zero. Add to that things like the firmware write line being controlled by a completely separate microcontroller, and the big things that are discussed are completely infe…

According to their documentation, the network module is "Intel Wireless Module". I assume Intel ME know how to talk to this one? https://www.orwl.org/wiki/images/9/95/SowDESIGN-SHIFTORWLPUB...

Only for the m7, because they enable vPro there. For the m3, vPro's not available, so the management engine won't be able to talk to the network card. Alternatively, you could just plug in your own USB wifi device, because it definitely wouldn't have the components for vPro to work.
Post reply on HN