Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uncorrectable freedom and security issues on x86 platforms (2016)

decentralize.today

Post reply on HN
Print view View original

21–30 of 141 posts

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#21

Post by Bartweiss »

KirinDave wrote: post #9

... I confess I'm very frustrated reading about how trusted computing modules hurt the cause of FOSS but no alternatives to actually try and carry out cryptography to execute trusted code. Inevitably the complaint is, "Well if they have physical access you're screwed anyways." And I just don't understand how anyone can maintain that farce when the last year has shown that it's a genuine challenge even for the US FBI…

I'm not sure I understand your argument here, and I'd like to.

For physical access, I though the case was "If anyone has access to your device while unlocked, or locked but not disk-encrypted, consider it permanently compromised. If anyone has access to it while disk-encrypted, consider replacing it if you're very concerned." The 'permanently' bit is for unknown firmware compromise, and this position seems pretty sane.

But trusted computing modules are something else altogether. Even non-physical access can compromise them. There's some evidence that they can be compromised around a fully-encrypted disk. And checking whether they're compromised is effectively impossible.

Yes, it might be possible to execute trusted code around the module, if it never hits the machine in a vulnerable form. But that's slow, non-interactive, and virtually nonexistent at present. Right now, trusted computing modules do compromise machines are roughly Ring -3, with no real recourse.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#22

Post by gizmo686 »

bogomipz wrote: post #13

I was struck by the following passage: >including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override." Can someone explain this to me, would this be for instance be Lenovo laptops making a deal with Microsoft since Windows is the default OS installed on these laptops? Is Microsoft mandating all OEMs/hardw…

Secure boot has 4 types of keys:

The signature database (db) and forbidden signature database (dbx) contain a whitelist and blacklist respectivly of keys, signatures, and hashes that are trusted to run.

Updates to either of the above lists must be signed by a Key Exchange Key (KEK). Most implementations allow multiple Key Exchanges Keys.

Updates to the list of Key Exchange Keys must be signed by the Platform Key (PK). Most implementations only allow 1 PK, and that PK is Microsoft's.

This means that any binary run on a secure boot machine with Microsoft's PK has a chain of trust rooted at Microsoft.

It may be possible to update the PK before transitioning the system to secure mode; but most consumer devices ship already in secure mode. This is different from simply disabling secure boot, which would still not allow you to update PK (for obvious reasons).

EDIT: It appears that it is called "user mode" and "setup mode" instead of secure mode.

Also it seems that some systems allow you to re-enter setup mode from the "bios" [0].

On an unrelated note, what do we call the firmware provided settings app now that it is no longer part of the BIOS.

[0] https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Co...

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#23

Post by throwawaysed »

0x0 wrote: post #8

Isn't it sci-fi-level incredible, and frankly both scary and shady, that every modern x86 CPU has this forced sub-ring-0 control program? And that the CPU vendors apparently go to extreme lengths in hiding its functionality? Why would even large vendors like Apple or Dell agree to this? The 30-minute timeout is particularly mischievous. It's like they REALLY want to slow down any effort at patching out the ME. Are we…

NSA 100% . Some time around 10 years ago governments decided the internet was too "dangerous" to be free. Arab spring cemented that into their minds, and now a bastion of free thought has become the worlds biggest spying apparatus.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#25

Post by jasonkostempski »

throwaway77384 wrote: post #14
jasonkostempski wrote: post #11

Earlier quoted context omitted.

Are there any projects out there that throw the baby out with the bathwater and just restart computing from the ground up with freedom as a foundation? I'd love to participate something like that and I think it'd be a great way to respark 80's like hacker movement.

Libreboot and coreboot are trying to open source things on the software side of things (think dd-wrt or openwrt or tomato for routers, custom firmware basically). With hardware it's a bit of a different story. You hear about attempts from time to time, but getting away from Intel / AMD is really hard. The suggestions from the article about alternative architectures seem to be our best bet currently.

Alternative architectures is definitely the most pragmatic thing to go for. I was going off on a bit of a tangent from the article and just wondering if anyone has tried redoing the 70's - 90's without trying to be compatible with any existing technology but still learning from the mistakes.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#26

Post by graycat »

I'm trying to understand all of this and especially the threats to privacy, control of my computing hardware, and data security.

I read about some new hard/software for secure boot, etc., but don't recall all the details now.

So, for a shorter approach, suppose I just buy a processor from AMD, a motherboard from ASUS, hard disk drives from Western Digital, etc., and plug it all together for myself. So, then I'm the manufacturer or OEM of my computer.

Q. 1. For what the OP is talking about, where do I have threats to privacy, control of my machine and its data, and security?

Q. 2. To use the machine I plugged together, do I have to get some keys from Microsoft?

Q. 3. Suppose I install operating systems from Microsoft, e.g., Windows 7 64 bit Professional, Windows 10, Windows Server or the database SQL Server. Then do I have to get keys from Microsoft?

Q. 4. Will the support processor and its software, whatever they are called, on their own without my knowledge or approval use the Internet to send/receive data from/to my computer, modify the data on my hard disks, etc.?

Thanks.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#27

Post by KirinDave »

the8472 wrote: post #19
KirinDave wrote: post #9

... I confess I'm very frustrated reading about how trusted computing modules hurt the cause of FOSS but no alternatives to actually try and carry out cryptography to execute trusted code. Inevitably the complaint is, "Well if they have physical access you're screwed anyways." And I just don't understand how anyone can maintain that farce when the last year has shown that it's a genuine challenge even for the US FBI…

> And I just don't understand how anyone can maintain that farce when the last year has shown that it's a genuine challenge even for the US FBI to unlock a mobile device without the owners say-so Difficulty? Yes. But the FBI is not the NSA, they don't specialize in such attacks. It's like asking your plumber to do heart surgery. So they commissioned it to else who does, and boom, they had access. Strong cryptographic…

I feel like you danced around the central point of my post: there is no suggestions for how to secure and harden devices without refining these trusted computing techniques. We need to harden these devices.

Your argument is no one can be trusted to make them. But my argument is that if you believe that then you know you can't trust anyone to make anything one way or the other.

Surely rather than botch the whole thing (because we don't like the vendors) we should start to propose stronger and more consumer-centric versions of these?

A skeptical and cyncial part of me notes: given the tiny tiny number of users who can actually verify their machines are what they say they are, all "trusted computing" rebukes do is argue against a tech that actually does mitigate rwal attacks for the vast majority of uses.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#28

Post by [deleted] »

awinter-py wrote: post #17

Is there evidence these have been used to harm anyone? Not that I wouldn't like a world with no more blobs (or at least reproducible-build signed blobs). But I use a ton of software I don't have time to review. Why is solving this more important than, say, looking for RPC holes in docker?

[deleted]

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#29

Post by zvalqoh »

1001101 wrote: post #20
throwaway77384 wrote: post #14

Earlier quoted context omitted.

Libreboot and coreboot are trying to open source things on the software side of things (think dd-wrt or openwrt or tomato for routers, custom firmware basically). With hardware it's a bit of a different story. You hear about attempts from time to time, but getting away from Intel / AMD is really hard. The suggestions from the article about alternative architectures seem to be our best bet currently.

Their attempts will be just that. There's a SHA256 signature required to verify the ME code - no signature, no boot (or boot for 30 mins less commonly). They won't share the keys with just anyone.

It's sha256?

I wonder if a Bitcoin shared mining setup could co-op some of those hashes to brute force the keys.

Re: Uncorrectable freedom and security issues on x86 platforms (2016)

#30

Post by carapace »

0x0 wrote: post #8

Isn't it sci-fi-level incredible, and frankly both scary and shady, that every modern x86 CPU has this forced sub-ring-0 control program? And that the CPU vendors apparently go to extreme lengths in hiding its functionality? Why would even large vendors like Apple or Dell agree to this? The 30-minute timeout is particularly mischievous. It's like they REALLY want to slow down any effort at patching out the ME. Are we…

"Rainbows End", Vernor Vinge

https://en.wikipedia.org/wiki/Rainbows_End

(see also https://en.wikipedia.org/wiki/Trusted_computing_base)

Post reply on HN