Slashdot Mirror
Researchers Crack Microsoft Feature, Say Encryption Backdoors Similarly Crackable (thehill.com)
An anonymous reader writes: Researchers who uncovered a security key that protects Windows devices as they boot up say their discovery is proof that encryption backdoors do not work. The pair of researchers, credited by their hacker nicknames MY123 and Slipstream, found the cryptographic key protecting a feature called Secure Boot. They believe the discovery highlights a problem with requests law enforcement officials have made for technology companies to provide police with some form of access to otherwise virtually unbreakable encryption that might be used by criminals. "Microsoft implemented a 'secure golden key' system. And the golden keys got released from [Microsoft's] own stupidity," wrote the researchers in their report, in a section addressed by name to the FBI.
proof that [anything developed by Microsoft does] not work.
FTFY.
That web site is annoying. 8 bit game music and the text jitters.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
When will the folks in Redmond put down the pipes?
Rotating golden key, moving starfield and crappy text. Virtually unreadable article. WTF?
Their security has a been a joke for *decades*.
Microsoft made a signed policy file which can be used with a Microsoft signed UEFI boot loader to turn off Secure Boot, and accidentally (?) published that policy with the Windows 10 anniversary update. Using this policy, Secure Boot can even be disabled on systems that won't allow the owner to disable it. And of course, this can be used to turn off Secure Boot remotely, so basically Microsoft eradicated any benefit that Secure Boot might have had. Now it's just annoying.
Show me an unhackable machine and I'll show you my bare arse.
Sounds like an easily exploitable security hole to me...
They read the specification, they reviewed the implementation, and they found a published key. I am unsure how people define "crack" but this seems more like "I reviewed stuff thoughtfully and published the findings".
The keys are supposed to be on a locked down system and signing is supposed to happen in one controlled place.
And if you do it that way you have created a single point of failure for the company - or at least all its deployed products. Kill that system, they're hosed. Ditto if (when) it dies.
So either they don't do it this "recommended" way or there is some kind of backup - which then also isn't this "recommended" way and becomes a potential security leak.
Dammed if you do, damned if you don't.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Can someone make a Linux build for these now and make them useful again?
Dear politicians: There will never be a backdoor key that only your law enforcement will have. Such things tend to be very, very valuable. Being able to decrypt any and all trade secrets is valuable. At a level where nation states start to be interested, not just some petty criminals, or even large criminal entities. Governments are interested. And they tend to have very, very deep pockets. Pockets deep enough that pretty much anyone becomes open for bribes. And if bribes don't work, well, there are other ways to be convincing.
Any key you have will also be held by Iran, Russia and probably even North Korea within reasonable time. That backdoor game is an odd one: The only winning move is not to play it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
We'd have no problem with that, if only gramps FBI would get offa our lawn.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Congress will never outlaw stupidity. When heave they ever made a law that has negative effects that affects mostly themselves?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
was the part where he was like HEY FBI SEE WHAT YOU DID THIS IS TERRIBLE YOU SHOULD FEEL BAD as if they are not sitting there laughing their asses off thinking "duh that was the point"
I think if you beat a dead horse for several years straight it becomes funny in an ironic way.
As A. Whitney Brown said on SNL: "There's no reason to beat a dead horse... except for the pure joy of it..."
... by outlawing disclosure of the the key, and declares victory over "sinister forces seeking to undermine our freedom" (whatever the hell that means.)
moral of the story, don't leave a bunch of old greedy fucks with no comprehension of technology to regulate it.
ELOI, ELOI, LAMA SABACHTHANI!?
Probably not. Copyright protects creative expression. There is no creativity involved in the creation of a cryptographic key, so copyright would almost certainly not apply.
Editor, A1-AAA AmeriCaptions
Microsoft can always be relied on
Not always. It's totally random.
Have gnu, will travel.
$10B is chump change to our government and the government can't be held liable in these endeavors.
Custom electronics and digital signage for your business: www.evcircuits.com
That is because nothing happens to the FBI if they screw up. Hence they screw up more and more, because screwing up is easier and cheaper than not screwing up. Power without accountability will invariably do that to any organization.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Because if you have the golden key, you can revoke and replace the golden keys and the personal keys held in escrow by Microsoft, and avoid the extremely cooperative Microsoft approach to providing these to any schmuck with a rubber-stamped piece of paper saying "government on it".
I was at the MIT lecture hall where Brian Lamacchia presented about the "Palladium" software, since renamed "Trusted Computing" and the core of "Secure Boot". The audience was very unhappy with his pretense that all this security structure was aimed at anything but vendor lockin and DRM and backdoors, rather than personal privacy. Microsoft's storage of *all* the private keys in their own personal escrow, with no policy on who or what could obtain personal or private keys without the owner's permission or even knowledge, was a dead giveaway.
I asked Brian "What would occur if Microsoft chose to misuse or mishandle this technology?" Brian said he and engineers like him would resign. I said "Like you resigned from .NET, and they did it anyway?" I don't think he realized people in the audience knew about that one. Brian is technically intelligent, but doesn't understand even office politics, much less the political hardball surrounding encryption.
Then, a bit later, Richard M. Stallman rose from his seat. Brian was *not* expecting rms! I wish I'd had popcorn for that moment, too, because Richard tore Brian a new one for locking people's own softwaer and computer resources away from their ownership and personal control. Some of us knew Richard and enjoyed the show: Brian apparently hadn't been paying attention to the nature of his audience, he was so excited to show of "ooohhh, shiny" toy.
Music: "Brand New Key"
Oh, I blew a software giant to smithereens,
I got its Golden Key.
Wonder what other tasks a wandering mind
Might have for me.
Is this megalomania?
Am I out of my tree?
Cuz I blew a software giant to smithereens,
I got its Golden Key.
Just curious is anyone knows whether MS can claim copyright in their master key?
Probably not. Copyright protects creative expression. There is no creativity involved in the creation of a cryptographic key, so copyright would almost certainly not apply.
"no creativity" -- you clearly haven't read some recent copyrighted books, or listened to some recent copyrighted music (and I use the term "music" rather loosely here)
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw