Slashdot Mirror
Hardware TPM Hacked
BiggerIsBetter writes "Christopher Tarnovsky has pulled off the 'near impossible' TPM hardware hack. We all knew it was only a matter of time; this is why you shouldn't entrust your data to proprietary solutions. From the article: 'The technique can also be used to tap text messages and email belonging to the user of a lost or stolen phone. Tarnovsky said he can't be sure, however, whether his attack would work on TPM chips made by companies other than Infineon. Infineon said it knew this type of attack was possible when it was testing its chips. But the company said independent tests determined that the hack would require such a high skill level that there was a limited chance of it affecting many users. ... The Trusted Computing Group, which sets standards on TPM chips, called the attack "exceedingly difficult to replicate in a real-world environment."'"
'near impossible'
Shouldn't that be 'near inevitable'?
Infineon said it knew this type of attack was possible when it was testing its chips.
Did they mention this in their marketing and when selling the TPM FUD to governments and companies?
"exceedingly difficult to replicate in a real-world environment."
Meaning only powerful criminal organizations, companies and governments can probably gather the
required resources and people with the expertise to pull it off? Out of 6.8 billion people, how
many have the resources to do this? 1000? 10,000? What about in 5 years?
At what point will they admit its flawed? Probably when TPM2 is fully patented and ready.
Can the summary at least explain wtf tpm is?
Well that is the state of play according to TheInq http://www.theinquirer.net/inquirer/news/1591069/ex-army-bloke-us-ready-cyber-war
That near impossible = possible = bad security. The arrogance to think they are soooo smart and (almost) no-one will be able to crack their design. Well it only takes 1 person. But I am guessing about every secret service in the world already knew how to do this attack.
This one line changes things:
The new attack discovered by Christopher Tarnovsky is difficult to pull off, partly because it requires physical access to a computer.
You can't have a piece of hardware make your data safe forever. It only needs to be safe for as long as you use it.
This is my sig.
FTA "Using off-the-shelf chemicals, Tarnovsky soaked chips in acid to dissolve their hard outer shells. Then he applied rust remover to help take off layers of mesh wiring, to expose the chips' cores. From there, he had to find the right communication channels to tap into using a very small needle."
If the attacker has this much physical access to your system/data then you've lost LONG before the TPM chip failed.
When I saw TPM, the first thing I thought of was the CP/M variant that came with the Epson QX-10.
"But the company said independent tests determined that the hack would require such a high skill level that there was a limited chance of it affecting many users."
You're kidding me, right?
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
The requirement for physical access aside, it really doesn't matter how difficult the rest of the process is, since someone will eventually figure it out and implement software to do it automatically so any script kiddie can do it. Math -- crypto included -- is funny that way. Considering the amount of money companies invest in products like these, you'd think they'd figure that out sooner or later.
Proud member of the Weirdo-American community.
So he did this by access the information in the chips protected storage. Now that he has done this does it let us get at the set of possible keys or anything that would allow a software solution to defeating these things?
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
All you need is a good source of Brownian Motion.
Seriously... We're reading about how Chinese baddies are doing this and that to gain access to secrets and whatnot and it seems like every few weeks some previously unbreakable form of encryption has been compromised. Maybe it's time to greatly reduce our dependency on the digital world to secure trade and state secrets. I mean... Laptops and phones are lost/stolen all the time, why would anyone in their right mind trust transporting state secrets on a flippin' laptop??? We all know it happens and we all know it's just a matter of time before something horrible happens because some high ranking official has his laptop stolen while playing "toe tap" in the bathroom stalls of some random airport.
Fifty watts per channel, baby cakes.
http://xkcd.com/538/
If the data is valuable enough to steal a computer and try to hack the TPM chip using acid and needles, then it's valuable enough to threaten the person with the password to divulge it.
It does not matter how hard it was/is.
This message of success will assure that many other outfits will have a try at it for various reasons.
It's the proverbial ghost out of the bottle.
Since using technique involves reverse engineering the chip, this is a clear violation of the DMCA. So just find your local attorney and prosecute.
Problem solved. Nothing to see here move along. Thanks for playing. :)
While decapping chips is done all the time in failure analysis labs, it isn't easy, and it's even harder if you're trying not to damage the chip (or yourself) in the process.
Decapping usually involves concentrated nitric and/or sulfuric acids. Temperature control is important. You want to carefully dissolve the plastic without destroying the lead frame and/or the bonding wires going from the lead frame to the die. You also want to complete this process without losing any fingers or your eyesight -- highly concentrated acids. Rinse carefully with deionized water and test to make sure the chip is still functional.
Now you can feed the chip to your electron beam probe, FIB mill, or just take pretty pictures.
Not the kind of thing you're going to do in your kitchen!
So, you want to go back to analog? Is that what you're saying?
Faster! Faster! Faster would be better!
Make sure to hand in your geek card on the way out.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
This required physical access to the device. If you have unlimited physical access to any device, digital or analog, you will eventually be able to crack it, assuming you have the available resources. The key is to keep the bad guys from getting access in the first place, which isn't always possible. Even the best security has numerous weak points, like the security guards that only make $40K a year, or people that leave their devices unattended in public places.
Probably best to store all critical information on punch cards and secure them in a burn safe guarded by people that are already multi-millionaires.
I still cannot find the droids I am looking for...
I've been reading about this hack for days, but something seems fishy. Some of the earlier reports had him hacking the SLE 66 CL processor chip which is embedded in the TPM, not the TPM itself. This article also describes him as having to work with many copies of the chip to discover its secrets, but it has the chips being inexpensive ones from China. Problem is that Infineon is a German company and I don't think you can get Infineon TPMs cheaply from China. Putting this together, it's not clear to me that he has truly hacked an Infineon TPM. He may have hacked a similar chip and he assumes that the same attack would work on TPM.
However, there is a way for him to easily prove that he has done what he said. Every Infineon TPM comes with an RSA secret key embedded in it, called the Endorsement Key or EK. This key is designed to be kept secret and never revealed off-chip, not to the computer owner or anyone. And Infineon TPMs also come with an X.509 certificate on the public part of the EK (PUBEK), issued by Infineon. If Tarnovsky has really hacked an Infineon TPM and is able to extract keys, he should be able to extract and publish the private part of the EK (PRIVEK), along with the certificate by Infineon on that key. The mere publication of these two pieces of data (PRIVEK and Infineon-signed X.509 cert on PUBEK) will prove that his claim is true.
Obviously this works because it's possible to remove the (plastic/something) filling that the chip is made of and expose its circutry.
Would it be possible to cover the circutry with something that is extremely difficult to remove without also damaging the circutry? I would guess either something that requires any form of mechanical removal (obviously - glass?), or a less conductive metal alloy. If possible, even that a vital piece made of X is covered by material Y, and vital piece made of Y very very close to it is covered by material X, obviously the bottom layer connected and the top one isolated. Plastic/unconventional semiconductors anyone?
Thank you, Tarnovsky. Thankovsky.
When the computer is trying to protect its owner's secrets, the key should be in the owner's head, not stored in a chip.
If the owner of the device knows the keys that will decrypt their data, then having physical access should get them everything they want. Defeating TPM shouldn't be a problem, because TPM shouldn't be relied on in the first place. If you're using TPM in this situation, then your system is mis-designed and you needed to fix that even before TPM was defeated.
That type of scenario aside, the most common use for TPM that people talk about, is where the owner knows what they're supposed to know, but the chip is supposed to still treat them as hostile and not let them access whatever they want. We're talking about DRM. That is not a legitimate case and The World Won't Miss You.
(http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html)
I wish I could remember which senator was screaming his head off to get these put in all computers as a mandate by the U.S. Federal Government. Just another example of how competent the fed. gov. is and should NOT be trusted to ever tell the populace what they must do!
ANY type of security will become crackable.
New Economic Perspectives
I remember years ago when thinkpads introduced TPM chips there were engineers rattling off a long list of attacks the chips were not designed to protect against. Yes someone hacked it (with a needle?!??!?) but its like having your way with unencrypted and non-identity protected MS SMB protocols... You can demonstrate it and oooh an audience at Defcon but everyone who mattered already knew it could be done anyway.
My problem with the technology is not that it needs to have explosives built into the casing when people start sticking pins or put EM probes in the vacinity the IC instantly vaporizes. While that would certainly be cool its more of a basic question - what is the problem that TPM is trying to solve? Who does TPM protect what from?
Lets take the full disk encryption scenario for example. If you really care about your data you'll cheerfully input a novel passphrase each and every time the computer boots to gain access without question and make sure the memory is wiped and placed in a secure vault :) when the computer is not under your direct supervision.
Theres too much entropy in the key to make a brute force attack feasable so your just as safe as any other way of producing a master encryption key. If your computer is stolen just get another one and plop in a backup disk you've been keeping on the shelf and go on your merry way. The theif gets new hardware and none of your data.
How does a TPM make this scenario any better? It may make key management and rotation easier and more secure, it may protect components of the hardware from their owners..etc. But when you look at the basic equation if the TPM goes south or the computer dies then your data is now SOL because you can't access it. The management function of TPM is a tradeoff and IMHO not a good -- perhaps its necessary for general purpose use.
Use of TPM is better than morons using low entropy finger prints to log into their computers but at the end of the day in my view the technology seems to be answering the wrong question anyway.
Wrong. Real encryption with real key management can be either impossible (OTP) or effectively-impossible (AES) for someone to get around, even if they have physical access to your machin
You forget that humans are the weakest link. Torture the shit out of someone that knows the password, and you'll be home free.
This is my sig.
The Trusted Computing Group, which sets standards on TPM chips, called the attack "exceedingly difficult to replicate in a real-world environment."
Which means there will be a GPU app for it in a week, a device on thinkgeek that also turns off every TV in a tactical area in 2 weeks, and a breakout board from sparkfun in 3 weeks.
After details of the initial hard hack are made public, a circuit can be built to connect a circuit directly to the chip without having to disassemble the chip itself again. (this was already done initially). therefore, ***Buy/build this 10 minute circuit, clip pins 1 and 2 of transistor to chip pins x and z, and output to chip output pin y. now you are always trusted (bypass this chip essentially).
1) take christopher's (from article) data about pinouts of chip, and design circuit to bypass.
2) sell readykit or circuit plans on intertubes
3) every script kiddy/foreign government/etc can simply pop the keyboard off a laptop, hook up the circuit, and start hacking away at whatever drive encryption is in use.
4) Deja-vue *example: Read contents of chip without removing from motherboard* - (http://www.llamma.com/xbox/Repairs/Reading_Xbox_Hdd_key.htm)
5) Profit!
No matter how quick the method gets, having to work with hydrofluoric acid with the target machine means it's a risky procedure, as in "do you like having bones in your fingers?". It's not something you can reduce to a script and rattle out. It's not going to scale well to multiple machines, either.
That in itself is an argument against obscuring this exploit, of course. No script kiddies were going to suddenly run out and apply this opportunistically, so the risk of releasing it is low to nonexistent. Frankly if you're going to encase the component in epoxy, the possibility of an eavesdropping hack is implicit.
No kidding!!! What do you say at this point?
It really only needs to be replicated once doesn't it?
Somebody fixed The Phantom Menace? I'd like to see that.
Appended to the end of comments you post. 120 chars.
Why don't you have him just sign something with that public key signature rather than divulging the private key to the world?
Perhaps a signed copy of the Gutenberg Press release of Aesop's fables???
The Eagle and the Arrow
An Eagle was soaring through the air when suddenly it heard
the whizz of an Arrow, and felt itself wounded to death. Slowly
it fluttered down to the earth, with its life-blood pouring out of
it. Looking down upon the Arrow with which it had been pierced,
it found that the shaft of the Arrow had been feathered with one
of its own plumes. "Alas!" it cried, as it died,
"We often give our enemies the means for our own destruction."
The attack is interesting, but it's actually beyond the scope of what the TPM was designed to do. The TPM is primarily intended to provide three services: 1) hardware root of trust at boot, 2) fast and secure cryptographic operations (including key storage), and 3) remote attestation. This attack focuses on the second service, as it is designed to extract the cryptographic keys that are supposed to be stored securely. Yes, the attack succeeds and it's interesting, but a lot of people are missing the big picture.
TPMs were never designed to withstand this type of attack. With regard to "secure storage," the goal was to do something better than just storing your keys on an insecure device like a HD. The reason that this notion of security is good enough is that the TPM was also designed to be inexpensive. Would anyone buy a new desktop if the price suddenly jumped up to $10,000 for a Pentium? So the hardware protection is just supposed to provide a reasonable amount of assurance for the average user. If you're looking at highly sensitive environments (e.g., military), you shouldn't be using a TPM. There are cryptographic co-processors out there that have more robust protections against these types of attacks, but they cost a lot more.
This is hacking like sawing your front door out from the frame is picking the lock. Yes, they got in.
Or, perhaps, like coming home from a trip, kicking in your front door in Cambridge, and having the neighbors watch in amusement. With any luck, none of them would call 911 and tell the police that someone is busting into the house next door. Likewise, you will be losing your PC or notebook, but you will have some time to change your network and online passwords etc, if you're paying attention and not bound and gagged in the cave next door. Your hard drive, however, is fair game. Truecrypt means never having to say 'what password'?
And you'll WISH they were the Cambridge police.
Of course, if they're serious, you're dead already.
deleting the extra space after periods so i can stay relevant, yeah.
Statements like "this is why you shouldn't entrust your data to proprietary solutions" make me wonder what I've been doing with my life.
I have been researching on this hack for hours upon hours, and something just doesn't add up. Earlier reports were of him cracking the SLE 66 CL which is embedded in the TPM but is NOT the TPM itself. The chips he has been using are cheap ones from China. The issue at hand is that Infineon is a German company, just a little different from your run-of-the-mill Chinese company. When you sum these things up, you can't really surmise that he has in fact cracked the Infineon TPM. So what if he has hacked a similar chip? You can't just go around saying that you have cracked a top-of-the-line Infineon. Every chip is NOT created equally.
On the flip side, there is an easy way for him to prove me wrong. Every Infineon TPM comes with an Endorsement Key, basically an RSA secret key. The purpose of this key is that it should be kept secret and never realized off the chip, not to software, not to any other board component. Infineon TPMs come with X.509 certificates issued by Infineon. If Tarnovsky has truly hacked this one out, he should be able to extract and publish the private part of the Endorsement Key along with Infineon's certificate on that key. All that he has to do is show that he has these TWO pieces of data.
But is he up for it?
Security: http://xkcd.com/538/
-dZ.
Carol vs. Ghost
The article (briefly) mentions that the Xbox uses the vulnerable Infineon TPMs. I wonder if this hack will make it any easier to find the Xbox 360's CPU key and thus make it easier to jailbreak a fully patched console?
"There are Israeli companies that have made a good living doing exactly that for many years now." Thank you for confirming the existence of the Jew World Order.
I used to go by the name BoyHowdy when i was hacking DTV, I made a small circuit that used 3 hcttl chips to glitch the H cards that were killed on Black Sunday. I can say that this guy is for real, arrogant or not.
-=Mod=- -=Parent=- -=UP=-
mod parent up
http://hardware.slashdot.org/comments.pl?sid=1543104&cid=31076056
I have been researching on this hack for hours upon hours, and something just doesn't add up. Earlier reports were of him cracking the SLE 66 CL which is embedded in the TPM but is NOT the TPM itself. The chips he has been using are cheap ones from China. The issue at hand is that Infineon is a German company, just a little different from your run-of-the-mill Chinese company. When you sum these things up, you can't really surmise that he has in fact cracked the Infineon TPM. So what if he has hacked a similar chip? You can't just go around saying that you have cracked a top-of-the-line Infineon. Every chip is NOT created equally. On the flip side, there is an easy way for him to prove me wrong. Every Infineon TPM comes with an Endorsement Key, basically an RSA secret key. The purpose of this key is that it should be kept secret and never realized off the chip, not to software, not to any other board component. Infineon TPMs come with X.509 certificates issued by Infineon. If Tarnovsky has truly hacked this one out, he should be able to extract and publish the private part of the Endorsement Key along with Infineon's certificate on that key. All that he has to do is show that he has these TWO pieces of data. But is he up for it?
VS
http://hardware.slashdot.org/comments.pl?sid=1543104&cid=31077696
I've been reading about this hack for days, but something seems fishy. Some of the earlier reports [computerworld.com] had him hacking the SLE 66 CL processor chip which is embedded in the TPM, not the TPM itself. This article also describes him as having to work with many copies of the chip to discover its secrets, but it has the chips being inexpensive ones from China. Problem is that Infineon is a German company and I don't think you can get Infineon TPMs cheaply from China. Putting this together, it's not clear to me that he has truly hacked an Infineon TPM. He may have hacked a similar chip and he assumes that the same attack would work on TPM. However, there is a way for him to easily prove that he has done what he said. Every Infineon TPM comes with an RSA secret key embedded in it, called the Endorsement Key or EK. This key is designed to be kept secret and never revealed off-chip, not to the computer owner or anyone. And Infineon TPMs also come with an X.509 certificate on the public part of the EK (PUBEK), issued by Infineon. If Tarnovsky has really hacked an Infineon TPM and is able to extract keys, he should be able to extract and publish the private part of the EK (PRIVEK), along with the certificate by Infineon on that key. The mere publication of these two pieces of data (PRIVEK and Infineon-signed X.509 cert on PUBEK) will prove that his claim is true.
$100 says that this is damage control from Infineon by challenging Tarnovsky to something that they know, for whatever reason, he is unable to accomplish?
No, we need to switch over to using Johnny Mnemonics to carry our sensitive data.
Even in my earliest days, physical access to a box meant, my box. So to speak.
I'm not surprised that this system has been cracked. With sufficient knowledge of a system, with reasonable tools and physical access to a system, that system is likely to be compromised, plain and simple. This is a hardware hack, and I'm always fascinated with hardware hacks, bare metal hacks seem really cool; but I don't think they are "near impossible".
I applaud his hardware hack, but in light of the expectation of "near impossible", I'll be moving on to the next article.
TPMs are designed for three things: 1) establish a hardware root of trust for boot (i.e., make sure that you're actually booting your OS and not a rootkit first), 2) provide lightweight, secure and fast cryptographic operations (so you don't have to do something stupid like store a cryptographic key in plaintext on your HD), and 3) allow remote attestation of a computer's software stack
(1) You can have a root of trust for your boot sector rather easily without a TPM: have the BIOS store a hash of the boot sector; have it warn the user when it changes (pre-boot), and have the boot sector update program tell the user the new hash so he can compare it against what the BIOS says whenever it changes.
(2) fast crypto just requires a hardware implementation of DES/AES/RSA/.... Secure private key storage if you are root---just encrypt your private key with a password and chmod go-r it. For non-root users, you lose: root can always read all of your files and kmem anyway.
(3) Remote attestation is fine, until youtube will only send you videos if you attest to run Windows XX which won't let you store the videos. At that point, your choice isn't just "secure or not", it's "youtube or freedom to control my own computer". Pile NYT, disney.com and a few other highly desirable (to some) websites, and the norm will become computers that their owners aren't in control of. At least that's something to fear.
Yes, there are applications of TPMs for DRM, but that is a side effect and not a primary factor.
Yeah, your legs might fall off. Don't worry, that's a side effect and not a primary factor.
No, sorry. I don't want no (steenkeeng) DRM. I'll trust that the secret keys I store on my machines are kept secret from not-me, and use that for remote attestation (via ssh).
You're on Slashdot, so you probably already know this.
Others might not so I'll post this linky and mention that it IS available on several torrent sites (and so is part 2).
Show them to your kids before they get to see the crap one that Lucas messed up.
Do not meddle in the affairs of geeks for they are subtle and quick to anger
Time taken is no problem. Safes in a bank must be cracked before the bank is opened else you are caught because the safe is still in the bank.
Laptops are rather more portable.
PS, since this guy is in the real world, surely their statement is bollocks.
And for quanticle, if the most important layer of security is the physical, then why do you need the less important TPM? Your laptop is secured well enough by having software encryption on it.
To clarify-
Youtube search for "blackhat 2010" and watch his 8 part videos they posted everything.
This chip covers:
Xbox360
TPM
E-PASSPORTS -------- this is the one everyone should care about.
Medical cards
Conditional access (think sat tv)
and the list goes on!
he didn't need to crack open any computers, he bought the parts on tape-n-reel from hkinventory.com
regards