Controversial Security Paper Nixed From Black Hat 144
coondoggie writes us with a link to the Network World site, as he tends to do. Today he offers an article discussing the cancellation of a presentation which would have undermined chip-based security on PCs. Scheduled during the Black Hat USA 2007 event, the event's briefing promised to break the Trusted Computing Group's module, as well as Vista's Bitlocker. Live demos were to be included. The presenters pulled the event, and have no interest in discussing the subject any more. "[Presenters Nitin and Vipin Kumar's] promised exploit would be a chink in the armor of hardware-based system integrity that [trusted platform module] (TPM) is designed to ensure. TPM is also a key component of Trusted Computing Group's architecture for network access control (NAC). TPM would create a unique value or hash of all the steps of a computer's boot sequence that would represent the particular state of that machine, according to Steve Hanna, co-chair of TCG's NAC effort."
How could a presentation "undermine" security? (Score:5, Insightful)
Now crackers will have an advantage... (Score:5, Insightful)
I don't like the whole [trusted platform module] (TPM) because we consumers are are not trusted in the whole scheme.
But for the few us techies that get this P.O.S. "security" system foisted upon them by their clueless/soldout management, wouldn't be nice to be able to explain why the hacker(s) got through the night before?
Conspiracy shmiracy (Score:5, Insightful)
Probably realized... (Score:3, Insightful)
Correct me if I am wrong, but if someone adds something like this to a remote execution virus, they can install a virtual machine underneath Windows (any version) and have access to all data, including encrypted volumes?
Nah... I'm just paranoid.
Give it time (Score:2, Insightful)
Re:How could a presentation "undermine" security? (Score:3, Insightful)
Agreed. Another possibility is that one of them discovered a flaw with their method. Eleventh-hour bugs right before demos are the most evil ones of all.
Re:How could a presentation "undermine" security? (Score:1, Insightful)
It's very possible that the whole thing was called off because they didn't want to get treated like Dmitri Skylarov, who enjoyed the US Government's "hospitality" for quite a long time (even after Adobe dropped all charges against him) for pointing out that a supposedly "secure" encryption system was really just another ROT-13 equivalent.
Re:How could a presentation "undermine" security? (Score:5, Insightful)
Ding! Ding! Ding! This more than likely is the case. What is more likely to happen? These guys getting silenced and quietly removing their presentation or these guys figuring out they were wrong and quietly removing their presentation. If there was a threat from the company there would have been a leak about the reason for pulling the plug on the presentation. More than likely the presenter discovered a flaw and quietly pulled the plug.
DMCA anyone? (Score:5, Insightful)
My guess is that they could not go to the US from fear of being arrested for breaking the DMCA/some other law. I for sure wouldn't go to the US under any circumstances with information on how to defeat any kind of security.
Security by obscurity still seems to be the mantra.
Re:Reason for pull? (Score:4, Insightful)
My question is why would anyone place their information security "Trust" in MS BitLocker, or Indochinese hardware (TPM chips) that likely already contain built in backdoors for John Law, and corporate drones?
Open Source Full disk encryption is fast and free, open source Firewalls and process restricting software are available for those who just can't resist getting infected with the latest malware. Most Open Source security software developers are likely NOT under the control of Big Brother in any form, be it corporate drones or big government fascists.
So while I'm a little disappointed that the Back Hatters decided to forgo the presentation of cracking TPM, since it was never trustworthy or secure to start with, and since anyone serious about security would never use such a faux security scheme at the outset, cracking TPM and "Trusted Computing" was only a curiosity anyway.
The "Trusted Computing Initiative" is simply a way to provide vendors "Plausible Deniability" and to limit liability for allowing exposed data, nothing more.
Re:Reason for pull? (Score:5, Insightful)
Or, perhaps, like in science, they discovered a flaw in their own methodology that rendered the presentation pointless. It does happen. How many times has someone yelled eureka, only to have some genius say, "Uh, Bob, you still have the machine plugged into the grid, it's not under its own power"?
Re:Reason for pull? (Score:5, Insightful)
And still there are people, even here on Slashdot, who insist that anonymous speech is not a precondition for free speech.
Re:Reason for pull? (Score:3, Insightful)
Then why did they not just say that?
Re:DMCA anyone? (Score:3, Insightful)
Re:How could a presentation "undermine" security? (Score:5, Insightful)
Not saying it's right...but there are both carrots and sticks, and I have no doubt they are both used.
Vendors want TPM, not consumers. (Score:4, Insightful)
Re:Fess up (Score:3, Insightful)
How can you object to people attesting to things? People attest to things all the time. Do you get up in arms over the Good Housekeeping Seal of Approval? Do you insist that it is an infringement on your freedom that you can't use their Seal dishonestly in business?
Or how about the Verisign root CA key? This is the foundation for SSL security on the net. Do you think they should publish the private part so that anyone can forge signatures by that key and make their own attestations? That would destroy its security.
Secure attestation is the foundation of commerce in the whole world, as well as in the smaller world of the net. The TPM merely applies that same principle on a finer scale, allowing you to attest to the nature of your own software.
For my security, I don't trust anyone else holding the keys in these TPM chips. Apparently, you do.
No one else holds the keys in the TPM. Only the TPM holds the keys. The TPM owns the keys and never lets them go. That makes the TPM, from the security perspective, an autonomous agent; a little robot that obeys certain rules. Everyone knows what the rules are, and thanks to the keys embedded in the TPM which never leave, everyone can tell when a TPM is making a statement. This gives people confidence in what the TPM says.
That's the essence of this enormous threat that everyone is so up in arms over. That there could be an entity in the world that makes verifiable statements of known facts. The bottom line is that people want the ability to make their TPMs lie. Apparently no one can abide the presence of an honest agent in their life.
I call this complete bullshit. I have no desire to defraud or lie to anyone. Yet I want to preserve my own privacy and anonymity. These goals are completely consistent. And the TPM actually serves these goals. Because people know its rules and can trust what it says, the TPM can make statements about what I am doing that are reassuring to others, without me having to reveal any more information than necessary or any details. The TPM allows local filtering of outgoing information so as to add MORE privacy while allowing a degree of remote trust that is unimaginable today.
I could go on and on, but what's the point? You either won't understand or won't believe me. I have read thousands of pages of TPM documentation and understand this technology as well as anyone. You have read a few web sites that are totally biased in their presentation. Unfortunately millions of others are like you, and almost no one is like me.
Re:Fess up (Score:3, Insightful)
Because in this case, attestation means requiring a specific set of applications. If you are not using exactly the applications required by a particular service, you'll be locked out of that service. Bad for free software, bad for the free market, bad for the customer, but great for application vendors who can win themselves "trusted" status!
No, that's not what it means. Attestation does not mean requiring a specific set of applications. It means having the ability to believably report what software you are running.
There is no such thing as vendors who win "trusted" status. There is no such thing as "trusted" vendors. Special or "trusted" vendors are not a TCG concept. No group has more or better access to the TPM than anyone else.
I think I should be able to use whatever applications I want on my own machine.
You can!
I think I should be able to modify them.
You can!
But TCPA stops me doing that, by forcing me to adopt applications that are considered to be "trusted".
No, it doesn't. You can run whatever applications you want.
What it does do is allow you to report your software configuration reliably and believably. Maybe someone else won't talk to you unless you are running a certain software config. That's their prerogative. You can always tell them to get lost. They can't make you do anything you don't want to do. You can run whatever software you want and do whatever you want.
What you can't do is to force other people to behave as you would like them to. They have freedoms too.