Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German government warns Windows 8 is a security risk

zeit.de

Post reply on HN
Print view View original

121–125 of 125 posts

Re: German government warns Windows 8 is a security risk

#121

Post by progman »

marvin wrote: post #120
progman wrote: post #41

Earlier quoted context omitted.

It is even worse. The attempt to escape into OSS/Linux is a step in the right direction. But as long as we are dependent on mass consumer hardware then there is always a risk of being spied through hardware backdoors. In this case it doesn't matter which software we use. Even encryption is useless. It is NOT enough to avoid Windows 8 because the real problem is modern hardware that uses Trusted Computing chips. Trust…

Do you have any more information about the use of Trusted Computing/the Trusted Platform Module to remotely run arbitrary code on a victim's computer? This is news to me.

A mainboard with such a feature just needs a hidden remotely accessible subsystem that is completely protected by TPM and which has access to your system through DMA, to read bytes and to write bytes in whatever system (RAM, Harddisks, SDcards, USB, WLAN, etc).

Consider it a "dual system" mainboard with the usual hardware where you have full control, plus a controlling subsystem where you have no access at all. Everything could be done remotely but you couldn't see any evidence.

Re: German government warns Windows 8 is a security risk

#122

Post by progman »

64598u3wieodsk wrote: post #109
progman wrote: post #41

Earlier quoted context omitted.

It is even worse. The attempt to escape into OSS/Linux is a step in the right direction. But as long as we are dependent on mass consumer hardware then there is always a risk of being spied through hardware backdoors. In this case it doesn't matter which software we use. Even encryption is useless. It is NOT enough to avoid Windows 8 because the real problem is modern hardware that uses Trusted Computing chips. Trust…

Thanks for your insight. I completely agree. Can you recommend any tutorials and secure hardware components?

It is the job of the hackers to think about the whole mess, and to develop solutions that actually work and which guarantee freedom of speech to us. Hacking insecure systems is one thing but now they have the opportunity to prove how smart they really are.

Meanwhile you could google around for "Linux embedded systems".

Re: German government warns Windows 8 is a security risk

#124

Post by eru »

MichaelGG wrote: post #100
mjg59 wrote: post #80

TPMs can't be used to control which software you can install. All they can do is prove what software you're running, which means that a remote provider can choose whether or not to provide a service based on what you're running. Trusted Boot is about providing proof, not about enforcing local policies. Secure Boot can be used to restrict which software you can install, as demonstrated in Windows RT. But that has noth…

TPMs are also pretty handy for low-level corporate security. Setup disk encryption, store in the TPM then either boot directly (allowing RAM attacks) or require a PIN (requiring someone to break the TPM itself). That's a pretty nifty feature for general security. I think the distrust and confusion around TPMs and so on is due to Microsoft's moronic handling of Vista's protected playback system and people have extrapo…

I believe the Chromebook uses TPM quite well.

Re: German government warns Windows 8 is a security risk

#125

Post by marvin »

progman wrote: post #121
marvin wrote: post #120

Earlier quoted context omitted.

Do you have any more information about the use of Trusted Computing/the Trusted Platform Module to remotely run arbitrary code on a victim's computer? This is news to me.

A mainboard with such a feature just needs a hidden remotely accessible subsystem that is completely protected by TPM and which has access to your system through DMA, to read bytes and to write bytes in whatever system (RAM, Harddisks, SDcards, USB, WLAN, etc). Consider it a "dual system" mainboard with the usual hardware where you have full control, plus a controlling subsystem where you have no access at all. Every…

I agree that this could be done in principle, and even that it isn't unlikely that people are thinking about doing it. But is there any evidence that such a subsystem has ever been created? Are there any additional technical details surrounding this?
Post reply on HN