Slashdot Mirror
Researchers Crack Microsoft Feature, Say Encryption Backdoors Similarly Crackable (thehill.com)
An anonymous reader writes: Researchers who uncovered a security key that protects Windows devices as they boot up say their discovery is proof that encryption backdoors do not work. The pair of researchers, credited by their hacker nicknames MY123 and Slipstream, found the cryptographic key protecting a feature called Secure Boot. They believe the discovery highlights a problem with requests law enforcement officials have made for technology companies to provide police with some form of access to otherwise virtually unbreakable encryption that might be used by criminals. "Microsoft implemented a 'secure golden key' system. And the golden keys got released from [Microsoft's] own stupidity," wrote the researchers in their report, in a section addressed by name to the FBI.
proof that [anything developed by Microsoft does] not work.
FTFY.
That web site is annoying. 8 bit game music and the text jitters.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
When will the folks in Redmond put down the pipes?
Rotating golden key, moving starfield and crappy text. Virtually unreadable article. WTF?
Oh it works, just not they way people who are concerned with privacy want it to.
Their security has a been a joke for *decades*.
Microsoft made a signed policy file which can be used with a Microsoft signed UEFI boot loader to turn off Secure Boot, and accidentally (?) published that policy with the Windows 10 anniversary update. Using this policy, Secure Boot can even be disabled on systems that won't allow the owner to disable it. And of course, this can be used to turn off Secure Boot remotely, so basically Microsoft eradicated any benefit that Secure Boot might have had. Now it's just annoying.
Congress-critter: If it was just stupidity that was to blame, we'll just make stupidity illegal. Problem solved!
LEO: If stupidity is outlawed, only criminals will be stupid.
...but whoever's getting the golden key should put $10B in escrow as guarantee that it won't get leaked. If someone is asking for the key without offering a guarantee then they can't be trusted.
Ist sunk!
Now, I need to sue Microsoft for promising that my device is secure when it really is not. It was defective by design.
Show me an unhackable machine and I'll show you my bare arse.
Sounds like an easily exploitable security hole to me...
Encryption backdoors are untenable: We Already Knew That.
The FBI however, will continue to act like Grandpa who cannot hear properly, doesn't understand the music these days, and want's the encryption kids to get off it's lawn!!
They read the specification, they reviewed the implementation, and they found a published key. I am unsure how people define "crack" but this seems more like "I reviewed stuff thoughtfully and published the findings".
The keys are supposed to be on a locked down system and signing is supposed to happen in one controlled place.
And if you do it that way you have created a single point of failure for the company - or at least all its deployed products. Kill that system, they're hosed. Ditto if (when) it dies.
So either they don't do it this "recommended" way or there is some kind of backup - which then also isn't this "recommended" way and becomes a potential security leak.
Dammed if you do, damned if you don't.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Can someone make a Linux build for these now and make them useful again?
I think if you beat a dead horse for several years straight it becomes funny in an ironic way.
Dear politicians: There will never be a backdoor key that only your law enforcement will have. Such things tend to be very, very valuable. Being able to decrypt any and all trade secrets is valuable. At a level where nation states start to be interested, not just some petty criminals, or even large criminal entities. Governments are interested. And they tend to have very, very deep pockets. Pockets deep enough that pretty much anyone becomes open for bribes. And if bribes don't work, well, there are other ways to be convincing.
Any key you have will also be held by Iran, Russia and probably even North Korea within reasonable time. That backdoor game is an odd one: The only winning move is not to play it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
>security key that protects Windows devices as they boot up say their discovery is proof that encryption backdoors do not work
You can take the drive out and read it with Linux. You can not take a Linux drive out and read it with Windows.
Gee.
It was never intended to be protection because physical access to any Windows machine is merely the second time you can spy on it. The first time is when you boot it up and connect to the Internet. Who reads it? Microsoft, and the US Government.
Speaking of FBI in the summary... that roll 'em site .. don't even click it. The summary subtly and disingenuously portrays Microsoft as unconnected to the FBI. This is a bold face fucking lie. Slashdot is FBI, Microsoft is US government too.
As for doing what the police want, do the police want the public to continue to fund their salaries? The US public are not paying taxes so they can be spied on and gestapo'd by a bunch of lying dickheads eating donuts.
Fuck you Dice, you are bitches now. Fuck your FBI honeypot team too.
... it makes one feel warm and fuzzy to be reminded that Microsoft can always be relied on to do what is stupid and/or obnoxious.
was the part where he was like HEY FBI SEE WHAT YOU DID THIS IS TERRIBLE YOU SHOULD FEEL BAD as if they are not sitting there laughing their asses off thinking "duh that was the point"
Just curious is anyone knows whether MS can claim copyright in their master key?
I know that a patent is possible on a prime number, but have never heard one way or the other on copyright. Would have though it impossible, until the idiots at the 9th Circus said that an API can be copyrighted.
I think if you beat a dead horse for several years straight it becomes funny in an ironic way.
As A. Whitney Brown said on SNL: "There's no reason to beat a dead horse... except for the pure joy of it..."
... by outlawing disclosure of the the key, and declares victory over "sinister forces seeking to undermine our freedom" (whatever the hell that means.)
moral of the story, don't leave a bunch of old greedy fucks with no comprehension of technology to regulate it.
ELOI, ELOI, LAMA SABACHTHANI!?
It was never funny.
Because if you have the golden key, you can revoke and replace the golden keys and the personal keys held in escrow by Microsoft, and avoid the extremely cooperative Microsoft approach to providing these to any schmuck with a rubber-stamped piece of paper saying "government on it".
I was at the MIT lecture hall where Brian Lamacchia presented about the "Palladium" software, since renamed "Trusted Computing" and the core of "Secure Boot". The audience was very unhappy with his pretense that all this security structure was aimed at anything but vendor lockin and DRM and backdoors, rather than personal privacy. Microsoft's storage of *all* the private keys in their own personal escrow, with no policy on who or what could obtain personal or private keys without the owner's permission or even knowledge, was a dead giveaway.
I asked Brian "What would occur if Microsoft chose to misuse or mishandle this technology?" Brian said he and engineers like him would resign. I said "Like you resigned from .NET, and they did it anyway?" I don't think he realized people in the audience knew about that one. Brian is technically intelligent, but doesn't understand even office politics, much less the political hardball surrounding encryption.
Then, a bit later, Richard M. Stallman rose from his seat. Brian was *not* expecting rms! I wish I'd had popcorn for that moment, too, because Richard tore Brian a new one for locking people's own softwaer and computer resources away from their ownership and personal control. Some of us knew Richard and enjoyed the show: Brian apparently hadn't been paying attention to the nature of his audience, he was so excited to show of "ooohhh, shiny" toy.
Does anybody edit the links?
Music: "Brand New Key"
Oh, I blew a software giant to smithereens,
I got its Golden Key.
Wonder what other tasks a wandering mind
Might have for me.
Is this megalomania?
Am I out of my tree?
Cuz I blew a software giant to smithereens,
I got its Golden Key.
Which makes it even funnier.