3 ms·

So, security-wise, this doesn't mean much right now. I'm sure that being able to look at the firmware will allow people to attempt even more sophisticated attac

So, security-wise, this doesn't mean much right now. I'm sure that being able to look at the firmware will allow people to attempt even more sophisticated attacks on the SE but does it really change that much in terms of user security? I don't think so. Despite what is learned from the firmware, the actual encryption still relies on unique keys and unique hardware IDs. Someone would still need physical access to your device for any of that to be useful and there are far easier ways to get at the data when you have physical access and a boatload of time. Yes, this might lead to a method for decryption but that method will still, undoubtedly, be much slower than social engineering and other bypass methods.

willstrafach 9y ago
You are correct. In my opinion, more eyes on this is a good thing anyway.
- killjoywashere 9y ago
  I think it's a huge deal for Apple: their device remains secure for most users, as you say. Yet it also gives them a credible argument against being forced to build a backdoor for law enforcement.
  - sova 9y ago
    Intentional Achilles heel?
hdhzy 9y ago
Can't speak for Apple Secure Enclave but Intel Embedded Security threat model explicitly states that the firmware code is not encrypted and not meant to be secret. [0] [0]: http://www.apress.com/us/book/9781430265719 http://www.apress.com/us/book/9781430265719
- kogepathic 9y ago
  > Intel Embedded Security threat model explicitly states that the firmware code is not encrypted and not meant to be secret. Yep. The root of trust for IME is within silicon, so unless there's a serious flaw in their IME initialization process, it will only run code signed with the root of trust in silicon. I don't agree with the motivations behind the IME (DRM foremost), but Intel seems to have built a very secure trusted boot chain. If the IME cannot boot a trusted firmware, it will shut down the rest of the platform and you'll have a fancy brick. This has been the situation for many years and it's why you cannot buy Intel based computers without IME made after ~2008 (X200/T400). Although recently Trammell Hudson seems to have found a way to mostly disable the IME boot process on the X220. [0] ARM vendors offer a similar feature with their on-silicon root of trust. The BROM (boot ROM) on silicon will only load and execute code signed by a trusted authority. [1] [0] https://mail.coreboot.org/pipermail/coreboot/2016-November/082331.html https://mail.coreboot.org/pipermail/coreboot/2016-November/0... [1] http://rhombus-tech.net/allwinner_a10/a10_boot_process/ http://rhombus-tech.net/allwinner_a10/a10_boot_process/

willstrafach 9y ago

You are correct. In my opinion, more eyes on this is a good thing anyway.

killjoywashere 9y ago
I think it's a huge deal for Apple: their device remains secure for most users, as you say. Yet it also gives them a credible argument against being forced to build a backdoor for law enforcement.
- sova 9y ago
  Intentional Achilles heel?

hdhzy 9y ago

Can't speak for Apple Secure Enclave but Intel Embedded Security threat model explicitly states that the firmware code is not encrypted and not meant to be secret. [0] [0]: http://www.apress.com/us/book/9781430265719 http://www.apress.com/us/book/9781430265719

kogepathic 9y ago
> Intel Embedded Security threat model explicitly states that the firmware code is not encrypted and not meant to be secret. Yep. The root of trust for IME is within silicon, so unless there's a serious flaw in their IME initialization process, it will only run code signed with the root of trust in silicon. I don't agree with the motivations behind the IME (DRM foremost), but Intel seems to have built a very secure trusted boot chain. If the IME cannot boot a trusted firmware, it will shut down the rest of the platform and you'll have a fancy brick. This has been the situation for many years and it's why you cannot buy Intel based computers without IME made after ~2008 (X200/T400). Although recently Trammell Hudson seems to have found a way to mostly disable the IME boot process on the X220. [0] ARM vendors offer a similar feature with their on-silicon root of trust. The BROM (boot ROM) on silicon will only load and execute code signed by a trusted authority. [1] [0] https://mail.coreboot.org/pipermail/coreboot/2016-November/082331.html https://mail.coreboot.org/pipermail/coreboot/2016-November/0... [1] http://rhombus-tech.net/allwinner_a10/a10_boot_process/ http://rhombus-tech.net/allwinner_a10/a10_boot_process/