Slashdot Mirror
Controversial Security Paper Nixed From Black Hat
coondoggie writes us with a link to the Network World site, as he tends to do. Today he offers an article discussing the cancellation of a presentation which would have undermined chip-based security on PCs. Scheduled during the Black Hat USA 2007 event, the event's briefing promised to break the Trusted Computing Group's module, as well as Vista's Bitlocker. Live demos were to be included. The presenters pulled the event, and have no interest in discussing the subject any more. "[Presenters Nitin and Vipin Kumar's] promised exploit would be a chink in the armor of hardware-based system integrity that [trusted platform module] (TPM) is designed to ensure. TPM is also a key component of Trusted Computing Group's architecture for network access control (NAC). TPM would create a unique value or hash of all the steps of a computer's boot sequence that would represent the particular state of that machine, according to Steve Hanna, co-chair of TCG's NAC effort."
So, did they pull because they had a problem with the demos at the last minute, or is there a more sinister conspiracy-type explanation for this retraction?
This game will waste your life. Don't clicky!
If the chip is secure, then no mere presentation can undermine its security. If it's not secure, then there's no security to undermine. Don't shoot the messenger.
Ben Hocking
Need a professional organizer?
(emphasis mine.) Interesting. First time for such meta-commentary by a slashdot editor? I don't think we ever saw the same for one of Roland Piquepaille's many submissions...
The Online Slang Dictionary
Now crackers will have an advantage and the rest of us will be blind-sided.
I don't like the whole [trusted platform module] (TPM) because we consumers are are not trusted in the whole scheme.
But for the few us techies that get this P.O.S. "security" system foisted upon them by their clueless/soldout management, wouldn't be nice to be able to explain why the hacker(s) got through the night before?
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Trusted Computing is one security measure I'd like to see broken.
Yanked why? ... Maybe because security experts have already exposed *stolen/old/re-hashed concepts* and they didn't want to be embarrassed...
Infiltrated dot Net
...that there is more money just selling the presentation to the highest bidder. Then present it a year later.
Correct me if I am wrong, but if someone adds something like this to a remote execution virus, they can install a virtual machine underneath Windows (any version) and have access to all data, including encrypted volumes?
Nah... I'm just paranoid.
Help! I'm a slashdot refugee.
...more of a dark gray hat then.
Slashdot, where armchair scientists get shouted down and armchair theologians get modded up.
Maybe they are putting it on the back burner, not releasing the information and giving it time to get to the point that once they do release it there will be a much bigger effect. As it is now TPM isn't wide spread yet so give it a bit of time and then break it.
Those of us with perfectly good phones who aren't willing to pay $500 for something that doesn't really bring much new to the table.
Cool factor: 10
Usefulness factor: 5 (it really doesn't do much more than my RAZR V3xx)
Budget fact: -1
Burn karma burn!
120 characters for a sig? That's bloody useless.
PC hardware companies have one customer: Microsoft.
They have to sell their hardware to Microsoft. Oh, sure Microsoft doesn't pay for it directly-- they get consumers (both free citizens and corporations) to do that for them. However, the hardware companies must please Microsoft if they hope to be able to sell their hardware.
If Microsoft feels they are beset by an upstart operating system, one that does not have the financial or political clout to become "trusted," they may very well demand their suppliers provide the chips in *all* computers, not just high-end secure commercial systems.
So manufacturers may have no real choice in the matter.
Microsoft is to software what Budweiser is to beer.
I think it was the same people who failed to give us the vote on DRM, NAFTA, globalization and the New Coke.
My guess is that they could not go to the US from fear of being arrested for breaking the DMCA/some other law. I for sure wouldn't go to the US under any circumstances with information on how to defeat any kind of security.
Security by obscurity still seems to be the mantra.
Badgers, we don't need no stinking badgers! - UHF
Scheduled during the Black Hat USA 2007 event, the event's briefing promised to break the Trusted Computing Group's module, as well as Vista's Bitlocker. Live demos were to be included. The presenters pulled the event, and have no interest in discussing the subject any more.
Maybe because it never existed?
1.Announce you're going to present how to break Vista / TCM
2.Collect $$$$ from registrations
3.Claim the presentation is "cancelled"
4.Profit!
Please help metamoderate.
Nitin and Vipin Kumar are the creators of VBootkit and they were covered previously on Slashdot here: VBootkit Bypasses Vista's Code Signing.
I don't know how likely it is, but since no one has mentioned it I figured I would. Maybe they were simply offered a big pile of cash to keep quiet, and never speak of it again??
What takes fewer assumptions: To assume that MS or some other bigwhig of the TPA crowd sent them some Ahnulds with an "...or else" message, or to assume that they found out that either their presentation is flawed or that their findings aren't so new at all? Or maybe they want to up the hype (after all, they do have a security consulting company)?
Seriously. Keep the conspiracy low.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Wasn't there some movie about this? Nitin and Kumar go to Black Hat, or some such?
- First they ignore you, then they laugh at you, then ???, then profit.
Don't shoot the messenger.
Not only that, but the messengers shouldn't give up so easily. They have a responsibility to disclose their findings instead of letting people rely on insecure solutions, or letting them fall victim to losing control of what their PC can/can't do.
Twinstiq, game news
That'd be Hanlon's Razor -- "Never ascribe to malice that which can adequately be explained by incompetence".
Je fume. Tu fumes. Nous fûmes!
Yes, but when will Nitin an Kumar go to White Castle?
"Saddam Hussein cavorts with terrorists."
Because we all know that hiding your head in the sand is a sound means of securing systems.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I was wondering how long it was going to take someone to work some totally non sequitur U.S.-bashing into a technical discussion ... and there you went and did it!
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
...Or kick him down a well.
So our country can be free?
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
exactly... perhaps they just saw more $ to be made on a different route.
Kill your TV
Alright, who has been requesting this trusted computing platform bullshit? Speak up! I want to know the name of the one consumer who said "Yes, I really want computers that can be uniquely identified. I hate the freedom that being anonymous brings."
I do want a trusted computing platform. That's because I know how they work, and you don't. You think it limits what code you can run and takes away your anonymity. But those are all lies, fed to you by opponents of the technology, which you have blindly accepted.
The truth is that TC technology lets you prove the software configuration you are running, if you want to. That's it. This will be able to be done per-application, so that you can prove you are running a particular app while keeping other details private. I can think of many good reasons for this; yes, good, privacy-protecting reasons; even good, anonymity-protecting reasons.
But because of people like you who believe the Big Lie, the technology I need to improve privacy and anonymity on the net is being killed even in its moment of birth.
In case it wasn't clear, I did not write the summary nor the article that the summary references. I was just pointing out that, regardless of how one feels about DRM or TPM and what is being secured against, the concept that a presentation could undermine security implies a security based on obscurity, which is no security at all.
Ben Hocking
Need a professional organizer?
Unless they're Luddites, people aren't opponents of a technology for no good reason. TPM depends on someone else, somewhere, attesting to... something. The point is, it's out of your and my control, which means that there's someone else in control, who holds the keys. For my security, I don't trust anyone else holding the keys in these TPM chips. Apparently, you do.
I'm all for more security. I just don't think this is the right way to go about it, and all I can see it realistically being used for is for on the consumer side limiting peoples rights to use media how they want. For businesses, it may provide some additional security, but even then I'm dubious that proper permissions and access control don't fix that already.
My blog. Good stuff (when I remember to update it). Read it.
Remember: TPM is there so the vendors can trust the PC, not the consumers (hardware owners) - who are, as far as the vendors are concerned, untrustworthy...
It must have been something you assimilated. . . .
Unless they're Luddites, people aren't opponents of a technology for no good reason. TPM depends on someone else, somewhere, attesting to... something.
How can you object to people attesting to things? People attest to things all the time. Do you get up in arms over the Good Housekeeping Seal of Approval? Do you insist that it is an infringement on your freedom that you can't use their Seal dishonestly in business?
Or how about the Verisign root CA key? This is the foundation for SSL security on the net. Do you think they should publish the private part so that anyone can forge signatures by that key and make their own attestations? That would destroy its security.
Secure attestation is the foundation of commerce in the whole world, as well as in the smaller world of the net. The TPM merely applies that same principle on a finer scale, allowing you to attest to the nature of your own software.
For my security, I don't trust anyone else holding the keys in these TPM chips. Apparently, you do.
No one else holds the keys in the TPM. Only the TPM holds the keys. The TPM owns the keys and never lets them go. That makes the TPM, from the security perspective, an autonomous agent; a little robot that obeys certain rules. Everyone knows what the rules are, and thanks to the keys embedded in the TPM which never leave, everyone can tell when a TPM is making a statement. This gives people confidence in what the TPM says.
That's the essence of this enormous threat that everyone is so up in arms over. That there could be an entity in the world that makes verifiable statements of known facts. The bottom line is that people want the ability to make their TPMs lie. Apparently no one can abide the presence of an honest agent in their life.
I call this complete bullshit. I have no desire to defraud or lie to anyone. Yet I want to preserve my own privacy and anonymity. These goals are completely consistent. And the TPM actually serves these goals. Because people know its rules and can trust what it says, the TPM can make statements about what I am doing that are reassuring to others, without me having to reveal any more information than necessary or any details. The TPM allows local filtering of outgoing information so as to add MORE privacy while allowing a degree of remote trust that is unimaginable today.
I could go on and on, but what's the point? You either won't understand or won't believe me. I have read thousands of pages of TPM documentation and understand this technology as well as anyone. You have read a few web sites that are totally biased in their presentation. Unfortunately millions of others are like you, and almost no one is like me.
The hack does not specifically concern the TPM, from what I understand it just fools Vista into thinking the TPM validated it. But any further operations using the TPM would fail, so...
I think that's a pretty good reason to pull the presentation.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Out with it, then. What are these reasons?
I am trolling
If TCPA is such a great thing for users like me, why can't I have access to the private keys in the TPM within my own computer?
Because, as I explained, the point of the TPM is to be an autonomous agent whose statements can be trusted. If you had access to the TPM's keys, you could get it to lie for you, that is, you could lie on its behalf. That would make its statements useless as they would have no truth value, and would eliminate the whole purpose of the technology.
You might as well ask why you can't have a copy of Verisign's private root key. Because that would make assertions by Verisign worthless. It's the same principle for the TPM.
Only by giving the TPM keys that it and only it controls can we gain trust in assertions signed by that key. The only reason you would want those keys is so you can get the TPM to make false assertions. Why is lying so important to you? Why is honesty such a threat? That's the real question here.
I can think of many good reasons for this; yes, good, privacy-protecting reasons; even good, anonymity-protecting reasons.
Out with it, then. What are these reasons?
How about this for starters: Securing Peer-to-Peer Networks using Trusted Computing (Google cache). This technology can make P2P networks much more immune to attack and surveillance from outside, protecting the privacy and anonymity of participants.
How can you object to people attesting to things? People attest to things all the time.
Because in this case, attestation means requiring a specific set of applications. If you are not using exactly the applications required by a particular service, you'll be locked out of that service. Bad for free software, bad for the free market, bad for the customer, but great for application vendors who can win themselves "trusted" status!
No, that's not what it means. Attestation does not mean requiring a specific set of applications. It means having the ability to believably report what software you are running.
There is no such thing as vendors who win "trusted" status. There is no such thing as "trusted" vendors. Special or "trusted" vendors are not a TCG concept. No group has more or better access to the TPM than anyone else.
I think I should be able to use whatever applications I want on my own machine.
You can!
I think I should be able to modify them.
You can!
But TCPA stops me doing that, by forcing me to adopt applications that are considered to be "trusted".
No, it doesn't. You can run whatever applications you want.
What it does do is allow you to report your software configuration reliably and believably. Maybe someone else won't talk to you unless you are running a certain software config. That's their prerogative. You can always tell them to get lost. They can't make you do anything you don't want to do. You can run whatever software you want and do whatever you want.
What you can't do is to force other people to behave as you would like them to. They have freedoms too.