Slashdot Mirror
Controversial Security Paper Nixed From Black Hat
coondoggie writes us with a link to the Network World site, as he tends to do. Today he offers an article discussing the cancellation of a presentation which would have undermined chip-based security on PCs. Scheduled during the Black Hat USA 2007 event, the event's briefing promised to break the Trusted Computing Group's module, as well as Vista's Bitlocker. Live demos were to be included. The presenters pulled the event, and have no interest in discussing the subject any more. "[Presenters Nitin and Vipin Kumar's] promised exploit would be a chink in the armor of hardware-based system integrity that [trusted platform module] (TPM) is designed to ensure. TPM is also a key component of Trusted Computing Group's architecture for network access control (NAC). TPM would create a unique value or hash of all the steps of a computer's boot sequence that would represent the particular state of that machine, according to Steve Hanna, co-chair of TCG's NAC effort."
If the chip is secure, then no mere presentation can undermine its security. If it's not secure, then there's no security to undermine. Don't shoot the messenger.
Ben Hocking
Need a professional organizer?
Now crackers will have an advantage and the rest of us will be blind-sided.
I don't like the whole [trusted platform module] (TPM) because we consumers are are not trusted in the whole scheme.
But for the few us techies that get this P.O.S. "security" system foisted upon them by their clueless/soldout management, wouldn't be nice to be able to explain why the hacker(s) got through the night before?
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Yanked why? ... Maybe because security experts have already exposed *stolen/old/re-hashed concepts* and they didn't want to be embarrassed...
Infiltrated dot Net
...that there is more money just selling the presentation to the highest bidder. Then present it a year later.
Correct me if I am wrong, but if someone adds something like this to a remote execution virus, they can install a virtual machine underneath Windows (any version) and have access to all data, including encrypted volumes?
Nah... I'm just paranoid.
Help! I'm a slashdot refugee.
Maybe they are putting it on the back burner, not releasing the information and giving it time to get to the point that once they do release it there will be a much bigger effect. As it is now TPM isn't wide spread yet so give it a bit of time and then break it.
My guess is that they could not go to the US from fear of being arrested for breaking the DMCA/some other law. I for sure wouldn't go to the US under any circumstances with information on how to defeat any kind of security.
Security by obscurity still seems to be the mantra.
Badgers, we don't need no stinking badgers! - UHF
My question is why would anyone place their information security "Trust" in MS BitLocker, or Indochinese hardware (TPM chips) that likely already contain built in backdoors for John Law, and corporate drones?
Open Source Full disk encryption is fast and free, open source Firewalls and process restricting software are available for those who just can't resist getting infected with the latest malware. Most Open Source security software developers are likely NOT under the control of Big Brother in any form, be it corporate drones or big government fascists.
So while I'm a little disappointed that the Back Hatters decided to forgo the presentation of cracking TPM, since it was never trustworthy or secure to start with, and since anyone serious about security would never use such a faux security scheme at the outset, cracking TPM and "Trusted Computing" was only a curiosity anyway.
The "Trusted Computing Initiative" is simply a way to provide vendors "Plausible Deniability" and to limit liability for allowing exposed data, nothing more.
Or, perhaps, like in science, they discovered a flaw in their own methodology that rendered the presentation pointless. It does happen. How many times has someone yelled eureka, only to have some genius say, "Uh, Bob, you still have the machine plugged into the grid, it's not under its own power"?
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
And still there are people, even here on Slashdot, who insist that anonymous speech is not a precondition for free speech.
Proud neuron in the Slashdot hivemind since 2002.
Then why did they not just say that?
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Remember: TPM is there so the vendors can trust the PC, not the consumers (hardware owners) - who are, as far as the vendors are concerned, untrustworthy...
It must have been something you assimilated. . . .
Unless they're Luddites, people aren't opponents of a technology for no good reason. TPM depends on someone else, somewhere, attesting to... something.
How can you object to people attesting to things? People attest to things all the time. Do you get up in arms over the Good Housekeeping Seal of Approval? Do you insist that it is an infringement on your freedom that you can't use their Seal dishonestly in business?
Or how about the Verisign root CA key? This is the foundation for SSL security on the net. Do you think they should publish the private part so that anyone can forge signatures by that key and make their own attestations? That would destroy its security.
Secure attestation is the foundation of commerce in the whole world, as well as in the smaller world of the net. The TPM merely applies that same principle on a finer scale, allowing you to attest to the nature of your own software.
For my security, I don't trust anyone else holding the keys in these TPM chips. Apparently, you do.
No one else holds the keys in the TPM. Only the TPM holds the keys. The TPM owns the keys and never lets them go. That makes the TPM, from the security perspective, an autonomous agent; a little robot that obeys certain rules. Everyone knows what the rules are, and thanks to the keys embedded in the TPM which never leave, everyone can tell when a TPM is making a statement. This gives people confidence in what the TPM says.
That's the essence of this enormous threat that everyone is so up in arms over. That there could be an entity in the world that makes verifiable statements of known facts. The bottom line is that people want the ability to make their TPMs lie. Apparently no one can abide the presence of an honest agent in their life.
I call this complete bullshit. I have no desire to defraud or lie to anyone. Yet I want to preserve my own privacy and anonymity. These goals are completely consistent. And the TPM actually serves these goals. Because people know its rules and can trust what it says, the TPM can make statements about what I am doing that are reassuring to others, without me having to reveal any more information than necessary or any details. The TPM allows local filtering of outgoing information so as to add MORE privacy while allowing a degree of remote trust that is unimaginable today.
I could go on and on, but what's the point? You either won't understand or won't believe me. I have read thousands of pages of TPM documentation and understand this technology as well as anyone. You have read a few web sites that are totally biased in their presentation. Unfortunately millions of others are like you, and almost no one is like me.
How can you object to people attesting to things? People attest to things all the time.
Because in this case, attestation means requiring a specific set of applications. If you are not using exactly the applications required by a particular service, you'll be locked out of that service. Bad for free software, bad for the free market, bad for the customer, but great for application vendors who can win themselves "trusted" status!
No, that's not what it means. Attestation does not mean requiring a specific set of applications. It means having the ability to believably report what software you are running.
There is no such thing as vendors who win "trusted" status. There is no such thing as "trusted" vendors. Special or "trusted" vendors are not a TCG concept. No group has more or better access to the TPM than anyone else.
I think I should be able to use whatever applications I want on my own machine.
You can!
I think I should be able to modify them.
You can!
But TCPA stops me doing that, by forcing me to adopt applications that are considered to be "trusted".
No, it doesn't. You can run whatever applications you want.
What it does do is allow you to report your software configuration reliably and believably. Maybe someone else won't talk to you unless you are running a certain software config. That's their prerogative. You can always tell them to get lost. They can't make you do anything you don't want to do. You can run whatever software you want and do whatever you want.
What you can't do is to force other people to behave as you would like them to. They have freedoms too.