Slashdot Mirror
Intel to Develop Hardware Rootkit Detection
Jack writes "ITO is running a story on Intel's latest initiative - a hardware rootkit detector: 'Intel is trying to eliminate the human factor when dealing with root-kits detection by developing a new hardware-based technique to discover and notify users when they are downloading unintentionally a root-kit to their computer.'"
Seriously, why don't they work with Microsoft to do some kind of checksum and bonk the load when it fails? This 'small chip' smells like something which would persistently degrade memory performance. Why would that be more acceptable than an operating system or BIOS which would block root-kits, i.e. you can only touch this file, this partition, etc, as logged in as root. Oh, right, on Windows processes may run under root authority and be co-opted.
Gee, seems like it's been 20 years since DEC fixed those bugs in RSTS/E
A feeling of having made the same mistake before: Deja Foobar
I would think up something witty to say but...
Hardware base rootkit detector? Bad idea.
What if I want to run a program that behaves like rootkit due to company policy? Can I disable the rootkit? And if the users find out what would they think?
Who will watch Intel then?
According to Intel, their new project involves placing a small chip on a PC's motherboard to monitor persistently programs that might be affected of a malicious attack.
Pop the chip off the motherboard and your problem is solved?
He who knows best knows how little he knows. - Thomas Jefferson
*Tinfoil hat on* Its part of skynet to sneak in rootkits when they want...... skynet is not one computer it was all the computers with google toolbars instaled!!
is this not just treacherous computing by another name? "You're downloading Debian?! That's not allowed! *bleep* *bleep* illegal operation *passing details to NSA*!"
--
No, I didn't RTFA. I didn't RTFSummary either.
Who watches the watchman, eh?
Probably a court appointed officer who watches Intel watch Microsoft.
Or something like that
Wait until the internet is trained, or should I say controlled to restrict what passes, all in the name of security.
we'll just call it skynet
A feeling of having made the same mistake before: Deja Foobar
I'll just stick to using OpenBSD, Packet Filter, and common sense to keep my systems safe. Far more cost effective than what Intel is proposing.
Cyric Zndovzny at your service.
I don't think they do.
As the system grows, so the number of entry points which need covering will grow.
after reading the article, I think they are sneaking in paladium under our noses.
Using the rootkit news as cover.
should we tremble?
liqbase
Who will watch Intel then?
Why... Sony, of course.
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
This is simply a marketing tactic to attempt to gain acceptance for a technology designed to get humans out of the loop whether they like it or not. There is no useful purpose for a technology designed to "protect" a machine from its owner. This marketing tactic simply tries to propose the "but what if we're trying to protect the owner from their own stupidity" angle; however, that kind of thing could be done in software as well.
Aside from wondering what language the IT Observer Staff speak natively (because it isn't English) I have to wonder why "hardware" is necessary to detect a root-kit. I'm all for being able to flag memory as executable (and thus "read only" to programs) and data (and thus unable to execute code) because the last time I wrote self modifying code for a legitimate purpose was on the C64. But what does "a small chip on a PCs motherboard" have to do with rootkits? A rootkit fools the *operating system*, not the processor.
Either this is only memory protection (which I thought we could already do in modern processors and thus would make an additional chip redundant) or it is going to "connect the computers directly to the data" which is content free market speak. Or trusted computing, but it that market speak sounds different.
Sig under construction since 1998.
One more thing to get hacked.
...dealing with root-kits detection...
...monitor persistently programs that might be affected of a malicious attack...
...doesnt expect its project to replace various protect software...
The project is timidly scheduled...
It sounds suspiciously like memory segmentation and/or writeable bit in the page tables. It has been around since the days of the VAX at least, and in Intel chips since the 386 (and the i890 which preceded it, but died).
But the article is so vague and poorly written that it sounds like either the author didn't know anything about the subject or english was not his first language, or both.
Whats next? A hardware DRM scheme from Intel? *rolls eyes*
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
...for big buisness to enslave us. All it'll do is report competitors stuff as 'rootkits', while we are keeping our system 'secure'.
... the difference between a desired rootkit (encrypted magic folders, which hides and password-protects certain files, for example) and an intruding one? How would it respond? If it can't tell the difference then I hope the response wouldn't be to shut it down or stop it from working but some sort of warning. This seems a little weird though - stopping a software issue with hardware. Does that even make sense?
until Intel has a product to offer the masses that is all it is
vaporware
Politics is Treachery, Religion is Brainwashing
Rootkits are rarely seen on linux boxes, but always seen on windows box. Intel should look to a prevention then a cure, and windows is the problem. Its the same deal as microsoft making anti spyware software for windows. In both cases, windows is the core of the problem. Change from windows, or fix windows, one of those will help alleviate these problems. Intel should be instead pushing microsoft to fix their problems instead of just slapping yet another bandaid(tm) on. One day all these bandaids are going to come off, and the wound will be a huge infected mess that will have to be excised.
The only way i can see such a device operating successfully is if the system has a read ahead feature on the currently running Code Segment, which may spark inefficencies in the system. Or perhaps when the system is loading the binary in memory do the checks then, again inefficencies would crop up.
Then there are going to be applications which will need to utilise the same patterns of operation that malicious programs use, E.G Uninstallers which wipe considerable amount of data off block devices for instance.
Perhaps such a system could be implemented on a software level on the OS's buffer cache, sort of like the way the Linux Secure Journalling system was going to operate, but this was thrown out the window because of inefficencies.
Maybe i should RTFA
unless Intel tie such a thing to Windows how can it work? How can a generic piece of hardware detect how some paricular company decided to implement some piece of software (ie: Windows)?
Won't it go off as soon as it finds its own fritz chip?
Malike Bamiyi wanted my assistance.
How will they decide what a rootkit is?
It looks like they'll have to err on the side of rejecting programs that just happen to look like rootkits. What would those be?
If the OS vendor wants to release a patch or extension, won't it look "evil" to the detector chip? It will be altering the OS -- so maybe it is a rootkit.
It seems like the marketing is running things here. With the trusted boot stuff that was a different story -- that has a good theoretical basis.
http://www.thebricktestament.com/the_law/when_to_
You mean a massive, global corporation decided NOT to exploit the consumers through lies, deceit, and borderline-illegal business tactics?! That's crazy! There has to be an ulterior motive.
UNIX: A computer user is defined as a programmer. WINDOWS: A computer user is defined as a consumer.
Isn't a Hardware Rootkit Detector a rootkit iteself?
It's actually Quis custodiet ipsos custodes?
Makes itself more obvious...
"We need to connect the computers directly to the data, so the
human beings don't have to be the I/O channel, and elevate the role of the
human being to a more supervisory role..."
This has little or nothing to do with security and everything to do with Intel PR.
Intel has been smarting since AMD beat them to the punch with the NX bit.
The only thing a Rootkit will do that any other software install won't usually is over-write and modify a lot more system files than it should. Hardware can't be aware of which version of hal.dll you're supposed to be running (heck, it shouldn't even know you're running windows!). This really is something the O/S should be doing.
Which it does. If you follow best security practices, well, heck, you're not logged on with admin privelege anyway. So how is the rootkit going to overwrite your stuff anyway? Or has your system been compromised by a hacker through an open port exploit? So your firewall failed you and you haven't patched up your O/S, and if the hacker is installing the rootkit, there's no point stopping the rootkit, because he's already in and he's just installing his zombie housekeeping tools. It'll just slow him down a bit.
I am government man, come from the government. The government has sent me. -- G.I.R.
...maybe "rootkit can become a word too?
As we've all seen, there are other ways to get a rootkit than downloading it. Do they perhaps mean that the hardware watches for the execution of code that looks like a rootkit? (And what does it mean for code to "look like a rootkit" anyway?)
chown -R us ~you/base
I have heard of some hair-brained (whatever that means) schemes to stop or annoy people from changing the default setup, but this is just takes the cake. A hardware detection of software?
Basically it will be the start of DRM since in the end its going to be all about signing exectuables.
by "rootkit" you mean the Windows Vista installer?
insecurity asks the wrong question irritation gives the wrong answer
I am sure Sony is highly against this new campaign by Intel.
Any bets on which OS it'll support, or rather, which it won't work with?
I thought not.
H.
When VCR's are outlawed, only outlaws will have VCR's.
In all liklihood the people creating the virii are the same people offering to fix the problem. It's all just a ruse to get hardware level control of the world's computers. Those in control don't like people having too much freedom. They want to stamp it out. Same thing with terrorism. The people fighting it are the ones who created it. Typical dialectical bullshit.
Im scared of Trapper Keeper!
Who watches them now?
I see someone probably read a Dan Brown book.
Useing hardware to stop a software problem sounds really dumb, why not just make MS where you cant install root kits, i dont have a root kit on my linux box! Mircosoft should make windows, and windows advanced, with terminal commands, they should untie IE and the rest of windows i think that would help
"I do."
--- Sam Vimes, Terry Prachett's Discworld
I have no
Therefore such precautions are totally unnecessary.
Stupid.
Damn no mod points - I love it when something simple says so much. When it comes down to it, at some level, you're gonna have to trust someone. Might as well be the entity at the bottom - that'd be Intel, at the hardware level. Fact is, unless a human is hacking around in Intel''s hardware (a true unbiased third party) we just sort of inherently (sp?) trust Intel, AMD, ABit, ATrend, NVidia, etc. right now. Some extra protection against rootkits is hardly a bad thing.
Excuse my speling.
Making The Bar Project
What is the difference between that technology and the Data Execution Prevention (DEP) in Windows XP and some Intel/AMD motherboards? If someone could please clarify I would appreciate it.
I dunno... Coast Guard?
A Microsoft spokesperson was heard commenting on this news: "When we release Windows Vista, we intend to make it so secure that we fully believe it will render such technology totally unnecessary."
Will it come with automatic updates over the internet? The ability to detect new rootkits? The ability to let users run code they know is safe but still trips the alarm? Not slow the computer to the speed of the chip itself?
This sounds like a really bad idea from a bunch of people who are supposed to be really smart.
- d
Who will watch Intel then?
Why... Sony, of course.
While being funny, I think it underscorses a unique point about this proprosal that deserves some thought. It's all fine and dandy to check for rootkits and be big on security. If it was fair and labelled a rootkit as a rootkit, I wouldn't see too much problem with it. In a world of viruses, trojans, spyware/adware, etc... it would be nice to have one less thing to guard against.
But I see this as yet another way to bully the small guy who might be eroding a big corps market share ("Your software hurts us financially, shareholders blah blah blah, we'll throw a bunch of money at Intel and threaten them with out patent portfolio unless they mark it as a rootkit so it won't install."). Then at the same time allowing Sony to pull their rootkit crap and call it a "feature" and since it passed the "Intel Test" you could be sued for defamation of character or some such thing for daring to call a spade a spade.
Pete...
Just to combat stupidity.
Not to be harsh, but the average end-user goes "huh?" when they hear the word rootkit. They think that Internet Explorer is the one and only portal to the internet. (or AOL... it's kinda funny... my grandma asked what the refresh button was a while back) In fact, they probably don't even care that their computer use is being monitored.
Just hope that your end user relatives are too boring to really watch closely.
Sure, switching to Linux or Mac can do wonderful things (No! Don't stick the zealots on me! I'm one myself!), but the typical end user can (still...) kill a system with a few stupid programs.
Windows Vista security should be enough for anyone.
In other news, Intel secretely used the rootkit Sony secretely deployed via their Audio CDs. It appears that all they did was rename the file.
Click Click Bloody Click PANCAKES!
mod parent up
as soon as i saw the grandparent that was my first thought
This will fail.
That I thought of when I read this was 'Winmodem'... another example of a hardware/software mesh that never should have existed. Anyone else think that?
How the hell can you design a chip to monitor a general-purpose CPU and decide if the CPU is being used for a specific subclass of operation?
How can it do this without being intimately tied to the OS?
I mean, a multi-tasking, networked operating system with devices doing DMA and everything else, how the heck can it know what is dodgy?
Lost at C:>. Found at C.
I don't know if I agree with the general sentiment of trusting the hardware level in general, I do believe that in the current climate Intel and AMD are decent choices to trust with something like this. They don't have anything to gain by trying to sneak in their own crap - they want as many people to use their stuff as possible, and that includes Linux, BSD, and the other open sourcers. Intel makes bundles on Linux.
Unfortunately, the hardware vendors also have the most power when it comes to locking something down - a DRM chip would be a lot harder to avoid then a software counterpart. "This CPU will only run Genuine Windows." I could see it happening. And if you want an "unlocked" CPU, you pay a premium.
- It's not the Macs I hate. It's Digg users. -
the first thing I thought was:
How the hell is it going to know the difference between a rootkit and a security update to the kernel?
"City hall" in German is "Rathaus" Kinda explains a few things......
That was my first thought as well. Another question: who was watching them before? How do we know there are no backdoors at the hardware level? *dons tin foil hat*
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
The difference is that a virus can sabotoge the software, anywhere -- even at the kernel. For a sophisticated virus, you need to look for the virus from a trusted (uninfected) system. Also, software DRM can be easily disabled, for various definitions of easy (eg boot to linux and replace the DRM part with return true). I agree with you that the latter is the real deal.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Dang, I think I'm ready to *bless* Sony! It's good we have a shake-down every now and then; keeps the community on it's toes!
By the way, not only do I run FOSS on every box, but I have a policy of just upgrading my hardware a piece at a time. It's gotten to where I no more trust a machine vendor selling me a whole system than I would a hustler on the street corner selling gold watches. If I put every component in the board myself, I know damn sure what's there and what isn't. Ironic: My years of being a cheapskate computer user has paid off in having better quality systems!
A computer equipped with this chip has a big red button with the label "ROOTKIT PREVENTION SYSTEM TURN ON". When the user presses it, the computer displays a message ("For Great Justice") and disables the network connection and all external drives.
ALAN: It's called Tron. It's a security program itself, actually. Monitors all the contacts between our system and other systems... If it finds anything going on that's not scheduled, it shuts it down. I sent you a memo on it.
DILLINGER: Mmm. Part of the Master Control Program?
ALAN: No, it'll run independently. It can watchdog the MCP as well.
--Tron (1982)
It's not a lie. It's the truth with lossy compression.
When it comes down to it, at some level, you're gonna have to trust someone. Might as well be the entity at the bottom - that'd be Intel, at the hardware level.
Along the same lines, I guess somebody should post this -- lest all the 5+-digit-UID kiddies grow up thinking they can trust their C compilers.
David Gould
main(i){putchar(340056100>>(i-1)*5&31|!!(i<6)<< 6)&&main(++i);}
So, while I'm not entirely qualified to implement this, I have thought about something in the wake of the 'sony evil'. Basically, I've often wondered if it would be possible to physically separate all core OS files in a separate storage medium. This separate space would be, on the hardware level, read only most of the time. In order to install/update/patch the core OS portions, one would have to exit the running of the OS, and 'boot' into a specific mode that has permission(again on the hardware level) to write to the OS data space.
Using a physical switch or key on the machine to set this mode would work, and wouldn't be possible to boot the OS if write mode was enabled. A form of automation would also work, in that you could have it unset this switch upon exiting the update mode of the system. Something along these lines, neh? Then you would be limited to user space corruption/exploitation/etc. True, this is a fine line to care much about, but at least you couldn't exploit a buffer overflow or some such to modify system files.
Just my 2 coppers.
Probably something HAD to go at Tulane, engineering must have seemed low man on the totem pole, big bucks, less glory, less instant alumni $ lately. Perhaps if the world has $160 oil, overpriced Asian labor, and a superChinese military & yuan, this may later seem short sighted but they do have to react now. And US mgmt today is a now kind of thing, not that "vision thing"...
Tulane has tried to partly streamline between a stressed national private university and a respectable liberal arts college. Let's all wish them good luck, both students and the university.
Actualy, I want a new OS, something like plan 9 updated with.....APPLICATIONS.
:).
Bottom line we use computers to run applications, and realy shouldn;t have to get tied down running an OS. My atari ST works fine, OS in BIOS, not many rootkits on that. Now application rootkits that root the application, that another area of concern as applications sit on the OS so if a hacker gains access to your system at the level you deal with then they will get all the juice they need.
TCB, naaaaaa i'd never install an OS if I wanted that to work 100%
Hey, some of us 5-digit UID "kiddies" read that when it first appeared in CACM.
Those 6-digit whippersnappers, now...
-- Alastair
To use AMD chips.
(Although personally I'd prefer to avoid the whole x86 thing altogether. I compromise with x86-64, and some older PPC and Sparc boxes.)
-- Alastair
Mod parent Insightful (or Scary). It's just not Funny.
So we will get one more chip to watch over our shoulders. We will get to the point where the damn mobo will have more chips to watch over us than chips to do our jobs.
... well, in this case for some word - rootkit - 90% of the computer using population doesn't even know but hey, protection is always good, right ?
My point is, it's good (?) to have rootkit-protection. Still, an automated rootkit-detector will never ever in this life work flawlessly, on all OSes and for all kernels. How many times will it bother people unnecessarily. How many times will it block software because it falsely thinks it's malicious ?
Maybe I'm nuts, but I never trust any company saying that all they want is to protect me. Gte lost.
My feeling about this whole we-protect-you, we-protect-others'-IP, we-protect-others'-(c), we protect your computer, we-protect-your-files, etc. scenario is somewhat cautious and mistrustful. This kind of protection always means the cancelation of some freedoms that were natural till that point [maybe I'm going a bit far with this, anyway]. And these days people seem too easily willing to give up less or more of them for
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
if (manufacturerIsSony(manufacturer, os)) {
avoidLawSuite(os);
}
public void avoidLawSuite(os) {
die(os)
}
public void die(os) {
if (osFromMicrosoft(os)) {
haltWithShinyBlueScreenOfDeath();
} else {
segFault();
}
}
These posts express my own personal views, not those of my employer
After very careful consideration, I have found that it is quite possible and highly likely that Intel is in reality run by Illuminati terrorists and are partly guilty of the terrorist attacks who took place 11. September 2001! http://en.xiando.org/Illuminati_logos This IS a VERY serious accusation, so it is very important that good and honest people consider the accusation and more importantly: The evidence! Evidence available at http://torrentchannel.com/ documents how the US government for decades have used brutal and deadly force against innocent citizens with the help and support of huge global corporations. Check it out and see for yourself!
9/11: Never forget it was a false-flag operation
It's sounds like the usual Palladium (AKA NCIFIUEUF) sales pitch. Simply a marketing ploy.
I think palladium could be bypassed with a good rootkit. for example, movie/game rls groups could share a secret rootkit no on knows about ant constantly defy microsoft's efforts to have secure platform. With them not knowing what to patch, it seems like a good solution. No way they're going to find it in microsoft.
Way to go contradicting yourself
It is realy hardware rootkit detection or hardware rootkit with detection of other rootkits? :)
I have to totally agree with the parent poster. This is far less a new Intel technical initiative and far more a new marketing initiative -- for TCPA.
Considering the history of the Wintel monopolistic hegenomy, why should I as an IT professional accept at face value ANY third party control over the computers I govern, much less a hardware "solution" whose keys are held by whom (besides Intel)?
I would place far greater trust in an OS that supports memory segmentation between execute-only, read-only, and read-write, as well as a software "tripwire" equivalent, and signed OS and application updates, NOT TCPA.
PHBs who continue to accept new hardware "initiatives" from OEMs that operate in close collaboration with (repeatedly) convicted software monopolists risk not only their jobs, but also the continued financial health of the corporations that they run. Of course, considering the widespread application of the Peter Principle within that strata of management, any job loss invariably results in a golden parachute and even more lucrative job offers.
Not funny at all - it's just another attempt to pass off the trusted computing stuff as a good thing.
All the solutions so far (the NX bit, the chip the article refers to, etc) are partial solutions to the problem of componentisation of compiled software running directly on a processor. Even microkernels based on message passing are a solution for this problem. The real solution is this:
The memory map.
Just as each process has/can have its own page table, each software component in memory should have its own memory map. Each address in the memory map would lead to a new active memory map when jumped to, just like virtual memory leads to a new and different physical memory table.
By using a memory map, the 32/64-bit flat addressing need not be sacrifised, and each component in memory shall handle only its own memory range, without any access to other components' memory, unless the other components' memory is mapped in the memory map of the current component.
The solution seems like object-orientation in hardware, with the memory map pointer playing the role of this in programming languages. But it would be an efficient and straightfoward solution, making things like the 'user/supervisor' mode and kernel rings a thing of the past.
There is also another 'quick & dirty' solution for 80x86: augment a page table descriptor with separate bits of read/write/execute for each protection ring, as well a 'code' protection ring (that's 8 bits in total). The CPU would check, at each access, the code ring number of the page that IP points to against the ring number of the target page for the requested access (read/write/execute), and raise a violation if the source ring number is greater than the target ring number. Therefore there would need not be a need for a context switch to enter kernel mode, since jumping to kernel page would simply be a normal 32-bit call. This solution is so good that:
Fact = Malware is a problem
Spin1 = Malware can be *reliably* detected
Spin2 = Hardware is the answer
Lies = Intel will protect you from malware.
Nice PR work!
Until we address the root cause of our security woes, everything else is spin to ease those dollars out of our pockets. It's massively expensive to fix this problem, but we must be willing to see it: The homogeneity of our computing infrastructure is its gaping shortcoming. For any security mechanism we invent, the bad guys will build a crack. Until now we have focused on the the bad guy's "cost" side of the ledger - making it harder and harder, and thus more expensive, to find and build a crack.
Soon it will be time to address the "revenue" side of the bad guy's ledger, and indeed we've already started to some degree. Anti-virus products reduce the lifespan, and infectable population size, of a virus. This reduces it's overall effectiveness, or put another way, reduces it's "revenue".
We must reduce the value of much further, to the point where it won't be worth building the crack (in most cases anyway, Fort Knox et. al excepted). How? By ensuring that a crack can only work on a limited number of computers - which brings us back to homogeneity.
Windows for all, or Linux for all, and ANY ONE THING for all is a recipee for disaster (which, to some degress, and by some measures, is what we have today).
- The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
Considering engineers already secretly print pitures of things right in the chip... how hard would it be for intel to engineer the CPU itself to do the dirty work? Why would adding another chip from the same company to the board bring worries that arnt already there?
Open up your box and have a look at all of those chips, do you trust every one of those comanys?
What exactly is a root kit? To some, the functionality of what looks like a root kit is a valuable service, to others it's a root kit. There are lots of services that run on my Mac (as well as PCs) that to me are a PIA, but to others are extremely valuable. I'd like to turn off spotlight and a bunch of other startup programs on my Mac, but without really messing in the shell there's no easy way.
Windows has the same silly indexing service, but at least they make it easy to turn off with a GUI checkbox.
Hardware should do processing and calculation and that kind of stuff. Software should do the detection and monitoring, not the hardware.
I think this is a bad idea. People wouldnt have to worry about rootkits if they used an decent operating system.
I hope they dont put this thing, and if they do it, I hope that it can be disabled, or even better that it is disabled by default.
Hardware should not interfere with how you use the computer.
Its nice to see that geeks are effected by the natural progression of media too.
First there is the problem, which is real.
Then there is response, which is real.
Then there is FUD. Which is unwarrented.
Then there is marketting, which is amusing but unnescissary.
Root kits have been around for awhile, and this is the first one that has seen much attention. Just because of the former part of the proposition doesn't make them a huge threat. But the lay person will not see this, and thus think that Intel is saving western society. Fah.
A patriot must always be ready to defend his country against his government. -edward abbey
* 6 digit crowd hangs head - IAmTheDave (746256) *
Excuse my speling.
Making The Bar Project
Online gamers who suffer from cheaters would disagree. Movie producers who have a $10 million film to finance and want to make it available for download would also disagree.
People are so paranoid about TCPA, it's funny. Hello people, go read the specs like I did. You'll come away with a different impression.
The TPM chip is a tool just like encryption is. Like encryption it can be used for both bad and good. Just like PGP can protect criminal communication as easily as it protects commerce, the TPM can be used in many ways.
Let's clear up a few misconceptions:
- No, the TPM cannot stop you booting Debian. That's a dumb idea based on zero knowledge of what the technology does.
- Yes, it can stop you accessing certain content if you are running Debian, because the TPM prevents you from lying about the configuration of your computer.
Obviously, this "remote attestation" feature has the potential to be abused! For instance, Microsoft could (theoretically) lock non-Windows users out from microsoft.comIf the content provider (online music store or whatever) doesn't want you use Linux to access their content, tough cookies. But this already happens today: there are no DRM implementations for Linux and the only way to play back music bought from iTMS is to either run iTunes under Wine or strip the encryption. And that's only possible because FairPlay is not a terribly good implementation of DRM - try playing back music bought from the Yahoo! Music Store, which uses Windows Media and you'll find you can't.
And equally obviously, remote attestation has legitimate uses as well: it can be used to do more robust anti-cheating programs like the Warden that protects WoW, and it can be used to prove to a remote computer that you are rootkit clean which would be useful for detecting spyware at the university/corporate network level.
The only way hardware will prevent a rootkit is if they get smart and have the OS installed to a flash RAM that has the write function protected by a physical key. The OS would only be able to boot off the flash RAM. The OS could only be updated by the person holding the key. System libraries could be replaced AFTER the system was up, but with a know secure version sitting in secured memory, it would be easy to watch over them.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Not necessarily. I'm perfectly comfortable with remote attestation being used by the administrator of a corporate or government network to enforce their policies. To do this, the administrator only needs to load a private key into each TPM and use it for remote attestation.
But stangely enough, TCPA doesn't allow that. Instead, it forces the administrator to use the factory-configured key. Why, you say ? Because a TPM without a factory-configured key couldn't be used for DRM. When 100% of PCs have a compliant TPM, nobody can object to the deployment of DRM. But if it's only 95%, DRM won't be painless, and people will complain.
So the way to make TCPA customer-friendly (including the remote attestation feature) is to change the specs so that the owner of a PC can make his own decision: either keep the factory-installed key and enjoy the wonderful world of DRM and cheat-free online gaming, or opt-out and take responsibility for his keys.
AC
I Dunno...Coast Guard?
So I've heard. In both cases, the technology is being used to restrict the use of a computer against the wishes of its owner. Cheaters (in multiplayer games) are scum, but so are games which want to put tentacles throughout your system to monitor them; and in any case, the only sure way to prevent most cheating is to move all the relevant logic server-side, which solves all cheating problems other than bots. As for films available for download, I have every right to do whatever I want with such films as long as I don't give them to anyone else; DRM (TCPA-enabled or not) won't let me do anything the producers didn't anticipate, like putting it on my MythTV box, or on a video iPod or Neuros.
I already have; every last word of it. My impression has only grown stronger with being better informed.
Everything the TPM can do falls into two categories: the things you could *already* do without needing hardware (which are perfectly fine to support in hardware; I like the idea of hardware-accelerated crypto), and the things that have no purpose other than restricting the owner of a machine.
Very true, and I endeavor to correct that misconception when I see or hear it.
Exactly; remote attestation is the main issue with TCPA, since it is the only one that affects someone who chooses to opt out of using it. Everything else only affects those who don't control the software which runs on their computer, but remote attestation affects those who *don't* use such software and/or hardware. Every indication from the supports of TCPA is that this is the intent: to be able to ask a system to report its true configuration or not report anything at all, preventing any possibility of a different-but-compatible implementation.
First, note that there is yet another way to avoid it: just use SharpMusique, which doesn't put the DRM on it in the first place. Second, note that DRM is not the issue here, since it can already be done without needing TCPA (just not as effectively). The real issue is the ability to even talk to the store in the first place with a client that the server doesn't expect. The Free Software community has been excellent at creating *compatible* implementations of protocols even without documentation or cooperation; consider Samba for example, which TCPA could easily be u