Researchers Hack Intel's VPro

snydeq writes "Security researchers from Invisible Things Lab have created software that can 'compromise the integrity' of software loaded using Intel's vPro Trusted Execution Technology, which is supposed to help protect software from being seen or tampered with by other programs on the machine. The researchers say they have created a two-stage attack, with the first stage exploiting a bug in Intel's system software. The second stage relies on a design flaw in the TXT technology itself (PDF). The researchers plan to give more details on their work at the Black Hat DC security conference next month."

Comments

TXT? PDF? Wha?

[Yvan256]

a design flaw in the TXT technology itself (PDF).

So we need to read a PDF to read about flaws in TXT?

What do you mean it's not about plain text files?

Re:TXT? PDF? Wha?

[CannonballHead]

I can't you're joking. Whoosh if you are.

If not: TXT: Trusted Execution Technology

Re:TXT? PDF? Wha?

[CannonballHead]

My mistake.

1. can't tell if you're joking.

2. Execution, not Execution.

Re:TXT? PDF? Wha?

[Anonymous Coward]

I can't you're joking. Whoosh if you are.

If not: TXT: Trusted Execution Technology

Guillotin?

Re:TXT? PDF? Wha?

[Anonymous Coward]

Yeah cannonball what's the rush man? Trying out that new dvorak keyboard on /.?

Re:TXT? PDF? Wha?

[Anonymous Coward]

I demand all this malware to be executed!

Re:TXT? PDF? Wha?

[Yvan256]

Yes, I was joking. And no, I did not know TXT also meant "Trusted Execution Technology". It's not my fault if someone was dumb enough to choose a 3-letter acronym that's been used for decades in the computers domain.

Re:TXT? PDF? Wha?

[Anonymous Coward]

GUILLOSTEEL

Re:TXT? PDF? Wha?

[Sentry21]

Well of course, if they used a TXT file you might get hacked!

Re:TXT? PDF? Wha?

[Anonymous Coward]

It's fine to accidentally a verb here.

Re:TXT? PDF? Wha?

[Mikkeles]

"Trusted Execution Technology" should be TET, making this ...

(wait for it) ...

The TET Offensive!

Re:TXT? PDF? Wha?

[Anonymous Coward]

acronym

initialism

Design flaw in the TXT technology

[Anonymous Coward]

Apparently, loading a pdf into wordpad causes an overflow that allows arbitrary code to run as administrator.

Re:Design flaw in the TXT technology

[zappepcs]

And nobody would ever do that, would they?

Re:Design flaw in the TXT technology

[Meski]

Reminds me of when QA wanted a corrupt word file to test something. "Fine", I said, opened a word doc with hexeditor, made some random changes, saved it. Opened it with Word, instant BSOD. "A little less corrupt" said QA.

Re:Design flaw in the TXT technology

[lsatenstein]

Is it possible that with every cpu built, there is an ability to correct (replace) instructions with some microcode patches? If so, all one has to do is modify the cpu instruction set so that some instructions are not privledged, and you will break all security algorithms ever created.

Wii Homebrew Channel

[bluefoxlucid]

The Wii has perfect encryption and signing on hardware-assisting firmware and system software that can't be compromised. It uses a completely trusted execution stack to ensure only authorized applications run and to immediately detect and disable unauthorized third party software.

Re:Wii Homebrew Channel

[Adult film producer]

Is that a challenge you're proposing?

Re:Wii Homebrew Channel

[whoever57]

The Wii has perfect encryption and signing on hardware-assisting firmware and system software that can't be compromised.

Let me correct that for you:

The Wii has perfect ^H^H^H^H^H^H an encryption and signing on hardware-assisting firmware and system software that can't be ^H^H^H^H^H^H hasn't been compromised.

Re:Wii Homebrew Channel

[SL1200MKII]

Sometimes there is no need to compromise the encryption and authentication, just circumvent it. Have you looked at the stuff they have on

http://www.wii-modchips.com/

Re:Wii Homebrew Channel

[Trinn]

Apparently someone missed the sarcasm tags here.

This is NOT a Troll.

I would mod, but I figured since nobody'd posted this I'll do that instead

Re:Wii Homebrew Channel

[nobodylocalhost]

On the same note, has anyone cracked the xbox 360 hardware security? The only thing i see so far is that XFPS device which uses a "man in the middle" attack to hijack the connection between a controller and the console itself.

Re:Wii Homebrew Channel

[Spatial]

Yes. But you run the risk of being banned from the online service if the modification is detected, which costs money.

Re:Wii Homebrew Channel

[Anonymous Coward]

Yes. Google '360 timing attack'. All keys can be retrieved, at which point you can disable/bypass the encryption at any stage after the very first hardware-embedded loader signature checks.

Re:Wii Homebrew Channel

[marcansoft]

Someone's been living under a rock since December 2007.

I'll just point you to the recent 25th Chaos Community Congress Console Hacking talk (slides, video) which neatly summarizes a year of hacking and how much of a horrible failure Nintendo's security has been.

Spoiler: their signatures used to have 8-bit security. Literally.

We've had lots of fun.

Re:Wii Homebrew Channel

[lordSaurontheGreat]

No one can hack Wii because the development kit costs $1,700 per seat.

No programmer in their right mind would risk getting that toy pulled! Think: I could make it rich if I build the Wii's Killer App, but I could loose that chance if I do something stupid and get my SDK pulled!

Re:Wii Homebrew Channel

[Anonymous Coward]

"No one can hack Wii . . "

Wrong

http://www.google.com/search?hl=en&q=wii+mod+chip&btnG=Google+Search&aq=f&oq=

This can't be possible!

[fuzzyfuzzyfungus]

Every single trade magazine and free objective TCO whitepaper for months has been full of pictures of PC desktops with combination locks photoshopped onto them, and fulsome praises of VPro! How could it possibly be vulnerable? I'm going to go cry in my corner office in the management suite now.

Quick!

[MightyMartian]

Quick, somebody arrest these scoundrels! How dare they show flaws in technology! The next thing you know, fraudsters and pornographers will be taking advantage of this. THINK OF THE CHILDREN!!! THINK OF 9-11!!!

Re:TXT execution technology

[TheRealMindChild]

edit.com

Re:TXT execution technology

[Anonymous Coward]

pico

Re:TXT execution technology

[lytithwyn]

Emacs all the way. My method of execution would be C-x k {person's name}.

Re:TXT execution technology

[Bill, Shooter of Bul]

Ed, Man! Ed!

Thank you!

[Just Some Guy]

RMS calls this "treacherous computing", and I have to agree with him. This is a good development as it demonstrates quite nicely that DRM (which is probably the #1 use of VPro et al) in simply not possible. Thanks, ITL, for showing this as folly!

Re:Thank you!

[Anonymous Coward]

That is completely different that what DRM for multimedia is. For multimedia, they want you to be able to view the content without being able to copy them, which is fairly ridiculous.

For TPM (or whatever the marketing acronym is now), they're just using hardware to ensure that only signed binaries are executed. There's valid reasons to want this as a user. For instance, sign the kernel. On first run, error out saying the app isn't signed and ask you to sign it yourself (or for things like linux distros, the binaries are signed by the distro or repo). Thus viral infections by modifying binaries & rootkits become much more difficult (e.g. theoretically a system that starts out non-compromised cannot become so by modifying existing programs and would need you to actively sign compromised apps before they start).

Here's the overlap and the reason it's bad: from what I understand, the signing authority must be the TPM chip maker. Thus you're relying on potentially someone you don't trust to perform the signing, instead of being able to chose whome to trust. Very likely, it'll be used to strip the user of the capability to do what they want. For example, wanna play a DVD? Only friendly, region-obeying, DVD playing software is allowed. Wanna play music? Only software that honors DRM restrictions allowed.

Re:Thank you!

[Deanalator]

Bullshit, not a single person working on TPM at Intel thinks it will ever work for DRM. I say this as someone who as talked with several of the security architects and TCG liaisons (in a non-professional setting).

TPM does close to nothing to prevent local attacks. What it is meant for is to prevent remote attackers from digging too deep by providing a safe place to store keys.

It is used to sign code. What Joanna did is what she always does, she found a fun way to get arbitrary code to execute when only signed code is supposed to be able to.

Re:Thank you!

[IamTheRealMike]

Keyword, at Intel. TC is the work of a large committee, with many companies. If you read the specs the conflicting goals are obvious. Simple question - is the TPM meant to resist hardware attacks or not? Sometimes it is, sometimes it isn't. It's not very good at this currently, you could beat 1.1 TPMs with a piece of wire (literally), but Intel are moving them inside the south bridge, where hardware attacks will be much harder.

In theory at least TC can be used to implement better DRM, because it makes it harder for people to debug the implementation. But there are still many unimplemented features needed to make this work, eg, trusted I/O, and no real roadmap to implement them. And even when done, it'll be years before the technology is widespread, and it's so complicated I'm sure Joanna and friends will be able to find many more problems with it.

The real promise of TC is a way out of the malware quagmire. Being able to run a web browser and know - for sure - that it's not been compromised by a password sniffer or the like, well, that's a useful thing and that's what TXT lets you do (when complete). A remote voting app that can prove to the server that it's a real human casting the vote and not a bot? A very useful thing, perhaps even a necessary precondition for digital democracy. TC can make this happen. DRM? Well if you want a crappy inferior very complex form of DRM then sure, go ahead, but it'll be less secure and more expensive than the equivalent implemented in controlled hardware like the PS3, Xbox360, mobile phones etc ...

Re:Thank you!

[Just Some Guy]

Bullshit, not a single person working on TPM at Intel thinks it will ever work for DRM.

Funny, as it's the first listed possible application on Wikipedia. How could TPM possibly not be used for DRM? All the ingredients are there. From the same article:

Sealed storage could prevent users from moving sealed files to the new computer. This limitation might exist either through poor software design or deliberate limitations placed by publishers of works. The migration section of the TPM specification requires that it be impossible to move certain kinds of files except to a computer with the identical make and model of security chip.

Isn't that almost the very definition of DRM?

Re:Thank you!

[Anonymous Coward]

Excuse me... let me phrase that correctly: "Bullshit, not a single person working on TPM at Intel will admit that was designed for DRM."

The entire reason for the project (started back in the late 90s) was DRM - or, as one Intel engineer at a talk I attended put it - "making a system secure against its owner". Only later they decided, after users started to realise just what TXT really means for them (total control by the likes of Microsoft), that they would smother the whole "for DRM" thing and flatly refuse to ever discuss it. Instead they always emphasise the "security" aspects instead. Only morons are fooled - hello there.

Anyone who thinks that Intel is not about DRM is an idiot. Intel is *THE* DRM kingpin (HDCP etc etc).

Re:Thank you!

[redtail]

Right, the gnashing of teeth is not the DRM crowd, it is the government sponsored high assurance computing platform proponents. Today, low assurance systems like Linux and Solaris sit between SECRET networks and the Internet. Some hoped to use TxT to create high assurance replacements. But I'm sure they'll conclude this is the "last bug" and plow forward.

Re:Thank you!

[WarlockD]

Not to mention no easy local recovery. Try replacing a burned out motherboard on a server with bit locker. No recovery disk, no data:P

Re:Thank you!

[Alsee]

Orly?

What a load of crap. At best you are merely naive.

I am a programmer, and in particular I have studied the Trusted Platform Technical Specification documentation. All 332 pages of dense technicaleese. There is one particular page I would like to cite. In the TCPA Main TCG Architecture v1_1b.pdf on page 277 the documentation comes right out and announces the fact it is designed to be secure against "rogue Owners".

You are either mistaken, or you're full of crap. The chip is in fact designed to lock the computer against the owner. Yes, locks that are designed to protect the computer against it's owner will also prevent outside attackers from doing things that the owner himself is forbidden to do. However that is incidental. A hostile Trusted Computing system trying to lock computers against their owners is fundamentally different than a system designed to secure computers for the owner.

If you really do believe that this is solely intended for the benefit of the owner, perhaps you could answer some questions for me.

Why the absolute refusal to implement the EFF's Owner Override proposal? It would give the owner full control of his own computer while still securing against remote attacks. You could even secure against local attackers (other than the owner) by placing adding some sort of Owner Authentication element to the Override system.

Or how about my proposal? I merely want a printed copy of the master key to my own computer. I merely want the option to buy a computer that comes with a printed copy of my master key. (Technical note: I am referring to the PrivEK key, and having the option to export the RSK key encrypted to the PrivEK would be beneficial for ease and security reasons.) Go ahead, explain to why I am absolutely forbidden to know the master key to my own computer. Go ahead and explain why they absolutely refuse to PERMIT anyone to manufacture any compatible Trust Chip that permits the owner to know their own master key.

And best of all, explain to me all of the documented systems and plans to REVOKE and (for all practical purposes) brick any chip if they ever detect that you have learned the master key locked inside you computer, if you ever learn the master key to control your own computer, if they ever detect that you have the power and control to override any DRM system based on the chip.

And don't even try the line about how this revocation system is "not part of the chip itself". The chip was explicitly designed to secure the computer against the owner, the chip was explicitly designed to to support that revocation system, and the chip's technical documentation and design specification explicitly mention this revocation system.

The design specs endlessly list all of the things that the owner MUST be forbidden to be able to do, all of the things the owner MUST be forbidden to know, the specification even has a section that mandates that any owner's data under "non-migable keys" MUST be effectively impossible to back up and MUST be irretrievably lost if the chip ever dies.

And on and on and on. Yes, the chip was explicitly designed to consider the owner to be the enemy. The chip is explicitly designed to be secure against "attacks" by the owner. Yes, the current generation of chips are relatively vulnerable to physical attack - by the owner or by a hostile attacker. However it is fundamentally designed to lock against the owner, there is a supplemental specification on how to increase the physical security against the owner and how to certify hardware as possessing stronger anti-owner physical security, and there is mention in the CHIP speck itself and in supplemental specifications on how to revoke and lock-out any chip where an owner does manage to gain local override control over his own computer.

Yes, there are some people working on Trusted Computing with the intent of securing your computer for you, of protecting you against remote attackers. However that does not change the fact tha

Re:Thank you!

[Anonymous Coward]

Disk drives with hardware encryption are becoming common, perhaps the norm in the near future. Using the TPM, true practical disk encryption may finally become reality.

However, the embedded TPM chip contains a unique master key. Remember the days of Pentium III with its Processor Serial Number? Makes you wonder...

Re:Thank you!

[Achromatic1978]

Wow. Cause it's not like any random Yahoo could write something in the TPM article, is it... oh, wait.

Have you actually read that article, in particular that section? A lot of it is written amazingly badly - I wouldn't accept much of it as a Junior High English essay, the basic grammar and sentence structure at that horrible.

Re:Thank you!

[Just Some Guy]

Using the TPM, true practical disk encryption may finally become reality.

As long as your definition of "practical" includes "unrecoverable", as in what your data will be if your motherboard fails.

Re:Thank you!

[hairyfeet]

Bingo! We have a winner! You would have to be nuts to use TPM when something as mundane as a mobo failure can cause all your data to go poof. But I have a more fundamental problem with it. If I buy a car you better hand me the damned keys, I buy a house, a lockbox, same thing. There ain't no way in hell I'm shelling out good money on a PC that has a lock that they won't give me the damned keys to.

I avoid software that expects us to pay full price for a rental, and TPM is the same thing. Without the keys those that have the keys can flip the switch and my money just went to a doorstop. So I'll keep building my own desktops and buying laptops without any stupid locks that I don't have the keys for. The big OEMs can push that crap all they want, it just gives me a reason to avoid them. I am sure that as long as computers are built overseas there will be somebody willing to build one without a TPM chip to save a few bucks. And I'll be happy to buy from them. Voting with your wallet: its a good thing.

Re:Thank you!

[tehcyder]

That is completely different that what DRM for multimedia is. For multimedia, they want you to be able to view the content without being able to copy them, which is fairly ridiculous.

Why? The copyright owners don't want people making free copies and passing them on to people who then don't pay to view it.
The copyright owners have spent money and now want to make as much money back as they can, why is this ridiculous?

Re:Thank you!

[Just Some Guy]

The copyright owners have spent money and now want to make as much money back as they can, why is this ridiculous?

Their desire isn't ridiculous, albeit insanely greedy in practice. The basic idea of you being able to copy something to RAM but not back to disk is just nuts, though. At this moment, I'm unaware of any widely-used DRM scheme that's not cracked. That's because the whole idea is basically impossible, at least without Treacherous Computing.

Re:Thank you!

[jhol13]

Being able to run a web browser and know - for sure - that it's not been compromised by a password sniffer or the like, well, that's a useful thing and that's what TXT lets you do (when complete).

No it won't. If the said browser behaves erroneously on a particularly crafted web page the web page creator might be able (depending on the error) to take full control of the machine, e.g. by injecting remotely controllable ("telnet") Javascript applet.

For voting the TC cannot *prove* anything - again a simple overflow (either buffer or integer or ...) bug can make the bot look exactly like human to the TC. TC can "prove" provided there are no bugs. Which is lame.

Re:Thank you!

[Anonymous Coward]

but Intel are moving them inside the south bridge, where hardware attacks will be much harder.

not any more...
fairly obvious why anon I would think

Re:Thank you!

[Deanalator]

.. why is this ridiculous?

It's ridiculous because information isn't stuff, and any attempt to control information as if it was a physical object is going to fail miserably.

Re:Thank you!

[Deanalator]

While it may be inconvenient that they don't include a software path to disable security, there is still nothing stopping the user from just pulling the keys straight out of the hardware.

I have seen people pull TPM keys with about 1000 dollars worth of gear.

Even in best case scenarios for the RIAA, all it takes is one user cracking their TPM to generate as much clean media as they want, and then we are back to where we started.

Anti piracy groups have already far surpassed the point of diminishing returns, and piracy advocates out number them significantly. The message is clear. If your sales model is based on treating information as if it was actual physical property, you are going to fail miserably.

It might work for some DRM, like passing out a few sealed PDFs etc, but it will never work for mass media distribution, and I think more people are aware of that than you may realize.

Re:Thank you!

[Anonymous Coward]

Uhh...

Let us consider the portable device, more precisely the data security of one. Granted the operating device or its user isn't compromised, the only way to breach data security is to possess said device by finding it on street corner, or "obtaining" it otherwise. In short, the data is protected by default up and until the "owner" is changed. A secure device therefore MUST resist owners attempts to tamper. To ensure data availability, the real owner has but one option, the good old backup tape in a safe. Incidentally, you don't make 1:1 backups of block-level encrypted data. If this level of security is needed, the backup volume needs to be (re)encrypted with a separate key. Yes, with encrypted volumes, you really, really, need to back them up.

The secure device must be as restrictive as possible for maximum safety. Distribute master key printout? But why, it can only weaken the security.

Again. If you value your data (above the hardware), you keep a BACKUP. Personally, I'm worried about the prospect of tracing, and IDentification of device users, and the backdoors that could be placed, you know, to protect the children. I'd rather have the TPM time out and destruct than a master key...

This message will self-destruct in five seconds. Good luck, Jim.

Re:Thank you!

[Alsee]

pulling the keys straight out of the hardware

Oh, I absolutely agree.

But there is an entire litany of problems. They intend to progressively increase the anti-owner physical security, increasingly obnoxious self destruct mechanisms. They intend to revoke your public key if/when they detect that you have jail-broke your system, effectively bricking your hardware, and then you have to go out and pay for another entire PC that they will again revoke. And then there's the expectation that you are doing something wrong and criminal, the expectation that they can and will either sue you into oblivion or even put you in prison under the DMCA or some other new law they dream up. And then there's the problem that everyone who does rely on Trusted Computing actually winds up creating security disasters. Trusted Computing is built upon the security assumption that remote computers are (supposed to be) secure against their owners. This is a blatantly false assumption, any security system build upon invalid assumptions will fail. There will be spectacular security failures, and these events will be blamed on "evil hackers", and will of course only result in more pressure and legislation to consider it criminal for anyone to extract their key or otherwise jail-break their own computer.

And then of course there's the simple point that it is just plain stupid and obnoxious for an owner to need to go thought the cost and effort to (appropriately) extract their own key. And of course anyone offering services to preform that extraction will be considered a criminal, and anyone doing such extractions and reselling theses enhanced-capability computers will be considered a criminal.

Sigh.

-

Re:Thank you!

[bendodge]

Can't we just buy AMD?

Re:Thank you!

[Alsee]

Can't we just buy AMD?

Unfortunately things are not so simple, for two reasons.

One, AMD is going along with it and building their own version of the same thing. It's not clear if AMD actively wants to push this crap, or if they are reluctantly preparing their own version just in case it catches on.

Secondly, the entire point of Trusted Computing is to screw you over if you DON'T have it. You but some new music or some video or some software, and it only works on a New & Improved modern Trusted-Enhanced-Computer. If you don't have a Trust chip controlling your computer then you can't decrypt the Trusted-DRM music/movie/software. You go to a website, and it pops up a message saying you need a Trusted-Compliant computer. The website refuses to send the webpage to you unless your Trust chip sends a secure crypto message certifying that it is in total control of your PC. You want to run some game or other application that connects to the internet, and the computer at the other end drops the connection unless you are Trusted-Compliant.

You drive through McDonald's buying a pair of Happy Meals for your two young children, and each one comes with a FREE CD toy surprise. Your daughter gets a CD filled with the latest hot Britteny-Bubblehead music, and your son gets this super-cool Spongehead Squarepants computer game. And on the ride home your kids are all excited and arguing over who gets to use the computer first to try out their cool FREE disk first. And you get home and pop in one of the disks, and it says you need to upgrade your computer. And your kids start whining:
WHY DOESN'T IT WORK?
WHAT'S WRONG WITH THE COMPUTER?
IT'S SUPPOSED TO WORK!
OUR COMPUTER IS OLD!
OUR COMPUTER SUCKS!
WE NEED A NEW COMPYOOOOOOOOOTER!

And then your son starts with - well my friend Bryan has the Spongehead Squarepants game and it works on HIS computer!
And your little daughter starts with - Yeah! my friend Mylyssa has the Britteny-Bubblehead CD and it works on HER computer!

And they chant in unison:
WE NEED A NEW COMPYOOOOOOOOOTER!

And then mom and dad get sick of the kids whining, and they go out and pay several hundred dollars to buy a new Trusted-Enhanced PC running the latest Microsoft Windows Handcuff-Edition operating system, just to run the goddamn FREE motherfucking CDs for the kids. Because they don't work on your old obsolete computer without a Trust chip to decrypt them.

Or better yet, your boss sends you new secure e-mail. Trusted-secure email. because the new Trusted email has special security features - such as it cant be read on anyone's computer except the person who is supposed to get it. And you can't accidentally (or deliberately) forward that sooper-secret company email to anyone else. And because the boss gets a secure confirmation that it was received and that you opened it. And because the boss can set a Mission-Impossible style self destruct on it, so that it is securely deleted after reading. Or whatever. The new Trusted email has some funk security feature like that, that the boss wants to use. So he just starts using it and sending out those cool new features that are available in his new email sending software. Well, except you can't read the mail unless you have a Trusted Compliant computer. And if you tell your boss you can't read his mail, well guess what? It's your fault. He sent you an email, and you're supposed to be able to read it.And if you can't, well it's because you don't have the compatible software. It's because you have an old incompatible computer. And your boss most certainly does not want to hear your idiotic rant about how you don't want to upgrade to the latest Microsoft operating system, and he doesn't want to hear your idiotic rand about how you refuse to buy a new PC with some "evil" chip in it. Your boss just expects you to fix your problem and read the damn email.

And another fun one - your mostly-computer-illiterate mother or other relative send

Re:TXT execution technology

[Hordeking]

I toggle bits.

Another repeat: the unlockable lock

[Anonymous Coward]

Never a lock has been created that can't be broken.

Any time you see "unbreakable", "unsinkable" or similar claims, call your bookie: they will. The question is when, not if.

Re:Another repeat: the unlockable lock

[Anonymous Coward]

Then why can't I rip my SACDs yet? :(

Re:Another repeat: the unlockable lock

[Just Some Guy]

Then why can't I rip my SACDs yet?

Because in an age where 128Kbps MP3s are the norm, no one really cared about SACD or DVD-Audio to bother.

Re:Another repeat: the unlockable lock

[Chabo]

I know how to make a lock that can't be unlocked except by brute force: weld two pieces of steel together to make a solid ring.

If it can't even be opened with a key, you can't use a lock pick, can you?

Re:Another repeat: the unlockable lock

[RiotingPacifist]

Just use the analog hole, SACDs may be cracked eventually if somebody else starts using them though.

Re:Another repeat: the unlockable lock

[Chabo]

It's up to app designers to make the default bitrate more towards the "transparent" region.

I've been trying to get my friends (the more technically-oriented ones, anyway) to rip to FLACs to keep on their primary machine, and to use my program (see my sig) to convert to decent-quality Oggs or MP3s for portable use.

I convert to Oggs mainly because MP3s aren't designed for gapless playback, and they work with Rockbox. "-q 6" gives VBR at around 192kbps -- more than enough for a portable player going over a pair of earbuds, and I have the FLACs for when I'm sitting at home, with my good headphones.

Re:Another repeat: the unlockable lock

[Anonymous Coward]

Define "key".

Re:Another repeat: the unlockable lock

[Nethead]

The one I keep in my truck.

http://www.amazon.com/Bare-Tool-Cordless-Reciprocating-Contractors-Special/dp/B000VEUVZE

Re:Another repeat: the unlockable lock

[nobodylocalhost]

risking to be modded troll, i would like to say sure there is an unbreakable lock. An unbreakable lock is a lock that noone cares enough to break.

Re:Another repeat: the unlockable lock

[Anonymous Coward]

The question is how easy is it to open that lock without having the key? Clearly it is much harder if the implementation is done correctly in hardware. It is also more expensive. Furthermore, a hardware implementation generally means (or at least should mean) you need physical access to bypass it - at which point you've already given your attacker a significant advantage to do what they want.

Re:Another repeat: the unlockable lock

[Anonymous Coward]

There's already a hardware hack in progress. But, as you say, the format is so obscure there's little demand for such ripping.

Re:Another repeat: the unlockable lock

[Mitchell Mebane]

If you use LAME to encode your MP3s and play them on a supporting player, you can get gapless. Foobar2000 and Rockbox, at least, support LAME's gapless playback headers.

Re:Another repeat: the unlockable lock

[Muad'Dave]

I once had a Home Depot employee call that saw a "Sway-zull" instead of saws-all. Of course my wife and I call it that now in honor of her (the HD employee's) curious pronunciation.

Re:Another repeat: the unlockable lock

[smellsofbikes]

One-time pad encryption is unbreakable. Provably so.
Other modern algorithms like Blowfish may be breakable if you throw enough computers at them, but nobody has any idea how to break them, even if you had the entire world's computational hardware running for a thousand years. There is no known break (yet.)

The problem is that we're making rapid advances in strong cryptography, which is good for anonymity and secure online communication, but when companies use that same cryptography to protect their software, we're as hosed as any other wiretapper. They have more resources than we do, so they can afford the very best, and the very best is *very* good.

Re:Another repeat: the unlockable lock

[Chabo]

Last time I checked (admittedly, over a year ago), in order to encode MP3s with LAME's gapless playback headers, you had to encode the entire album (or at the very least, the two songs you want to be gapless) in one shot from the command line. So with an encoding scheme like those of Exact Audio Copy or FlacSquisher (my program), where encoding is done with one process per track, the MP3s will have space to fill in the last packet, and will fill it with empty samples, leading to gaps, no matter what player you use.

Correct me if I'm wrong, please. If I am wrong, then that's an extra feature that I can include in FlacSquisher's list! :)

Flaws? Or by Design?

[SpaceLifeForm]

Are they really design flaws? Or was this actually by design, and now the backdoor method has been discovered?

Bug in 'system software'

[Daemonax]

Is this 'system software', a driver for Windows, or is it a bug in the firmware and therefore compromises the security this provides regardless of OS? Also, if it's firmware, is it the type that's burnt into the hardware and can't be changed, or the type that's loaded by the OS? If the later, this seems to me like a good reason for companies like Intel to release the source code for firmware.

Re:Bug in 'system software'

[Anonymous Coward]

It is named the "SINIT module" in the TXT (public) documentation. It MUST be signed by the southbridge manufacturer (read intel) and represents the "DRTM" (Dynamic Root of Trust for Measurement). You can see this as a sort of "asynchronous BIOS" that can be started at any moment after boot (not at reset time) and which begins executing in a (supposedly..) temperproof region of memory (in fact a chunk of L2 cache behaving like a static RAM inside the CPU). This permits the launching of what they call a "trusted chain of boot" (trusted for who?..;))

Invisible Things Labs is J. Rutkowska (Blue Pill)

[paleshadows]

"Invisible Things Labs" means, more or less, Joanna Rutkowska, discussed in these related slashdot stories

• VM-Based Rootkits Proved Easily Detectable
• Blue Pill Myth Debunked
• Hacker Defeats Hardware-based Rootkit Detection
• Rutkowska Faces 'Blue Pill' Rootkit Challenge

Re:TXT execution technology

[LostInTransportation]

Real programmers use butterflies.

Hmm

[Anonymous Coward]

The Wii has 232 bit elliptic curve encryption. While it hasn't yet been broken, someone I believe did break a 109-bit key. There isn't security that will ever exist which can't be broken.

Re:Hmm

[Darkk]

That's ok. Somebody with a dozen or so Sony PS3s clustered together to crack the Wii's 232bit encryption key so it'll be a matter of time.

Re:Hmm

[Skuto]

109-bit ECC keys give about 2^54 security
232-bit ECC keys give about 2^116 security

It's only a difference of 2^62!

Wrong Wrong Wrong

[Glasswire]

vPro is mostly about AMT OOB management which is secure and is in it's 5th generation. TXT is relatively new component which is implemented virtually nowhere yet and has virtually nothing to do with the AMT functionality that has been and is being implemented hundreds of sites. AMT management is 97% of what vPro really is and is what the industry system OEMs generally mean when they say vPro. TXT is a future technology waiting for ISV enablement whereas core AMT/vPro is real and here now. Saying that because TXT may be compromised AND suggesting that the primary, working part of vPro is insecure is outrageously misleading.

Re:Wrong Wrong Wrong

[Anonymous Coward]

Do What?

Alphabet Soup...

Re:Wrong Wrong Wrong

[Koiu Lpoi]

I'm going to be completely honest here: I have no idea what you just said, and I fear that expanding your acronyms would push your post to multiple pages.

Re:Wrong Wrong Wrong

[lazyforker]

vPro is mostly about AMT OOB management which is secure and is in it's 5th generation. TXT is relatively new component which is implemented virtually nowhere yet and has virtually nothing to do with the AMT functionality that has been and is being implemented hundreds of sites. AMT management is 97% of what vPro really is and is what the industry system OEMs generally mean when they say vPro. TXT is a future technology waiting for ISV enablement whereas core AMT/vPro is real and here now. Saying that because TXT may be compromised AND suggesting that the primary, working part of vPro is insecure is outrageously misleading.

Thanks for the post. This is just what I wanted to say. My team has specified vPro PCs to replace the current PCs specifically for the management features. If you manage a large PC environment it's worth taking a look at.

Re:Wrong Wrong Wrong

[Anonymous Coward]

He must work at intel. The only place I've ever worked where the acronyms required a dictionary website to explain them to employees.

A very large website no less.

Re:Wrong Wrong Wrong

[Anonymous Coward]

Believe me, it isn't the only place. But I shouldn't mock Harry Potter.

Re:Wrong Wrong Wrong

[wildstoo]

From Wikipedia:

Intel Active Management Technology (AMT) is hardware-based technology for remotely managing and securing PCs out-of-band.

Also from Wikipedia:

Out-of-band is a technical term with different uses in communications and telecommunication. It refers to communications which occur outside of a previously established communications method or channel.

In this case it means remotely changing system (BIOS) settings etc. while workstations/servers are 'powered down'. There's more to it than that, of course. Check the features list on that linked article.

Re:Wrong Wrong Wrong

[Glasswire]

Ok, I'll give you the short-as-possible version for the acronym-phobic. vPro (not an acronym) is an umbrella brand covering a bunch of technologies (including the Trusted Execution Technology that was hacked). But that's a really minor feature that is hardly being used yet because the software world is still working on implementing it. Dozens of management software companies from Microsoft to LANDesk to Symantec to Cisco and Checkpoint DO support the Active Management Technology out-of-band management features in vPro which have been around for years. This lets admins remotely power-up/down systems watch the Power-On-Self-Test and control the Basic-Input-Output-System (you may have heard of that one.. BIOS :-)) redirect boot to a remote Compact-Disk ( Phillips trademarked as CD) image file and apply network filers at the Network-Interface-Controller level using a secure Internet Protocol (techies call this IP) routeable remote console AND do all this out-of-band when there's no Operating System (OS to some people) running on the Personal Computer (which many people seem to recognize as a PC).

And the security of all this good stuff has nothing to do with the Trusted Execution Technology exploit - even though they're both pieces of the vPro bag of capabilities. Ok?
(Sorry for the sarcasm, but except for TXT, the only acronyms I used were industry standard terms, not Intel word-salad)

Re:TXT execution technology

[m.ducharme]

Isn't there an Emacs Key combo that does that?

Re:TXT execution technology

[RazzleDazzle]

Real programmers code in binary

Re:Invisible Things Labs is J. Rutkowska (Blue Pil

[lifeflaw]

Exactly, that's by now, "old news".

Blue Pill

[meridian]

I believe this is based on the Blue Pill attack (from the same person) which essentially is a hypervisor that mimics the underlying system to gain access to the encryption keys. The flaws in the attack are that it is complicated to fully mimic the underlying hardware in software, the main drawback being that the timings by the hardware would be out due to the software hypervisor layer and this may be detected by the underlying OS or software running underneath the hypervisor. However it may be possible to write a hypervisor that takes all things into account but this would be quite an extensive task. ie. it is quite complicated to do properly but fesible (from what I have read). Mimicing the underlying system and the software interface to this via a hypervisor would allow access to the encryption keys. The article says basically "this is first stage attack, will produce stage 2 when intel responds to this" so they obviously have not completed the extensive programming task to take all things into account. Intel have known about this issue for some time as I asked one of their lead engineers the question a few months back if Trusted Execution was known to be totally secure and he basically said that theoritically it could be broken and told me to google "blue pill".

Re:TXT execution technology

[jonas_jonas]

What does this have to do with cows?

wrong concept of owner?

[ovu]

Isn't vpro intended for business ?

In this case, the protection mindset is oriented towards overall network and data integrity and NOT for preserving the non-existent freedoms of individual machines and "owners".

The concept of a rogue owner makes perfect sense in this context.

Re:wrong concept of owner?

[flight666]

Bzzt. wrong. try again.

You confuse "owner" in this case with "user".

The owner of the machine is the business that owns it, while the user is the poor guy sitting at the keyboard. It is perfectly reasonable for the owner to want to protect against a rogue user. But all of the comments in the grandparent thread still apply. The legitimate owner (even if it is a business) still owns the physical hardware and has all the same concerns a regular person would have.

Re:wrong concept of owner?

[Alsee]

First, the other person who already replied to you was absolutely right. Even in the case of business, the business itself or the business owner is the owner of the computer. And it is still illegitimate for the system to consider the owner to be the enemy. This system is still attempting to secure the computer AGAINST the owner.

Second, yes, Intel has explicitly said that vPro is intended for home PCs as well. This stuff is just targeting the business market first.

Next, the "rogue owner" quote was from the Trusted Platform Module (TPM) technical specification. The TPM chip is the central component of vPro. The TPM is explicitly targeted for both business and home use. In fact the Trusted Computing Group has explicitly announced their intention for this chip to become "ubiquitous", a standard component of essentially all computers and most other digital devices.

And lastly:
NOT for preserving the non-existent freedoms of individual machines and "owners".

Ha. Putting owner in scare quotes.
When I buy a computer I AM the owner. Not some sarcastic-scare-quotes "owner". My computer is my property. I have every right to rip open my computer, or do whatever I like with it. It is entirely illegitimate and nonsensical to call me an "attacker". I cannot "attack" my own property because anything I do is inherently authorized, legitimate, and rightful.

If I run a small business, then I AM still the owner. Not some sarcastic-scare-quotes "owner". I still have every right to rip open my computer, or do whatever I like with it. It is entirely illegitimate and nonsensical to call me an "attacker". I cannot "attack" my own property because anything I do is inherently authorized, legitimate, and rightful.

If a major public corporation owns a computer then it IS the owner. Not some sarcastic-scare-quotes "owner". The management of that company has every right to rip open that computer, or do whatever they like with it. It is entirely illegitimate and nonsensical to call them an "attacker". They cannot "attack" their own property because anything they do is inherently authorized, legitimate, and rightful.

Trusted Computing is designed to be hostile. It is designed to consider the rightful owner to be the enemy. It is designed to "secure" computers against their rightful owners. Trusted Computing is malicious and malignant.

-

Clever guys

[Anonymous Coward]

Now if they could take a look at hypervisor found in PS3 machines...

mnb Re:Another repeat: the unlockable lock

[Anonymous Coward]

Last time I checked (admittedly, over a year ago), in order to encode MP3s with LAME's gapless playback headers, you had to encode the entire album (or at the very least, the two songs you want to be gapless) in one shot from the command line.?

You are confused. That was never the case. Much less as recently as a year or two ago.
In particular - you are confusing the old "-nogap" switch with LAME gapless playback headers.

The headers document the encoder delay and last-frame-gap so that a compliant player knows how much silence is on either end.

What you describe, on the other hand, is LAME's option switch which delivers MP3 gapless to non-LAME-aware players. What it does is shift (ever so slightly) the split point between two adjacent files (tracks) so that it falls on an even frame boundary and thus any spec-compliant decoder is gapless.