4 ms·

Same with TPM and why it had so many critics. Some people still seem adamant to say that boot viruses are the greatest threat in the 21st century, but the econo

Same with TPM and why it had so many critics. Some people still seem adamant to say that boot viruses are the greatest threat in the 21st century, but the economic interest are far more dangerous for general computing in my opinion. And it isn't even close.

vanderZwan 4y ago
So basically, Cory Doctorow's "The Upcoming War Against General Computation"? https://boingboing.net/2011/12/27/the-coming-war-on-general-purp.html https://boingboing.net/2011/12/27/the-coming-war-on-general-... https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip... Don't know enough about the subject to tell if his "attempts to control general computation will converge on rootkits" prediction has held up.
- q-big 4y ago
  To this talk, there exists a less well-known sequel: DEF CON 23 - Cory Doctorow - Fighting Back in the War on General Purpose Computers https://www.youtube.com/watch?v=pT6itfUUsoQ https://www.youtube.com/watch?v=pT6itfUUsoQ
  - vanderZwan 4y ago
    Thank you for bringing this to my attention, will check it out after work
- nibbleshifter 4y ago
  > "attempts to control general computation will converge on rootkits" prediction has held up. If you play video games, you probably have a couple of neat kernel rootkits installed as "anti cheat". A lot of remote proctoring stuff for exams are looking a lot like rootkits too. EDR/XDR is also just rootkits. For security. The only thing that can stop a bad guy with a rootkit is a good guy with a rootkit, after all.
  - agileAlligator 4y ago
    Kernel rootkits are going to be redundant pretty soon. There are cheats out there that use video captured by capture cards as input for an AI on a separate computer to actually play the game like a human would. Once that becomes widespread there is no way to stop it, save from banning capture cards entirely.
  - mwint 4y ago
    The remote proctoring stuff is downright dystopian. I bought an extra laptop to do tests; most people can’t do that and have to install this garbage on their daily driver. Of course, I guess most people don’t care.
    - nibbleshifter 4y ago
      What's hilarious is it doesn't seem to prevent exam cheating in any meaningful way anyway, according to some students I've chatted to.
      - mwint 4y ago
        It really doesn’t. I took an exam in a meeting room at work with huge TVs on the wall… they made me show them the TVs were “unplugged”, so I just unplugged some random thing from the wall and they were happy. The TVs are hardwired, it’d be trivial to have an accomplice show answers or whatever on them.
ChuckNorris89 4y ago
Can you explain what is the issue with TPM? I get the issue with Pluton but TPM is only a dedicated and certified secure key and random number generator that does a better job than CPUs doing it in software, and it's also a secure enclave for storing your encryption keys. Would you rather store the keys in memory where they can be easily grabbed by malicious apps like Mimikatz? Macs had the same feature for years in the T2 chip. It's the exact system that enables wireless payment and other strong security features on your phone. So having TPM on PCs and using it for its interested purpose is a boon for everyone's security so I don't see the issue, just FUD.
- furtiman 4y ago
  Among that, the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration. Simplifying the description of the process a bit - at every bootup it checks the checksum of all programs loaded at every boot stage (UEFI, kernel, userspace) with respect to one that is known to be approved - process called "attestation". So in worst case, if your attestation server is very strict, any new binary installed on your machine will prevent it from booting or satisfying the attestation. This is the main concern that TPM enables.
  - aplanas 4y ago
    > the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and "legit" (via PCR#10 extension). As you state later, it is this 3rd party the one that assert (verify) if you are state considered OK or not. Maybe I am too simplistic, but I do not see the evil in the TPM here, but only in the 3rd party policy. TPM can be abused but, as a developer, I am happy that we can use the TPM for good and fair goals in open source projects. It is the user who can decide to use the TPM or not, and should be noted that in the TCG specification it is stated that the TPM can be disabled and cleared by the user at any moment.
xjay 4y ago
2013: German Federal Government Warns on the Security Dangers of Windows 8 https://www.infosecurity-magazine.com/news/german-federal-government-warns-on-the-security/ https://www.infosecurity-magazine.com/news/german-federal-go... 2015: Governments recognize the importance of TPM 2.0 through ISO adoption https://www.microsoft.com/security/blog/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/ https://www.microsoft.com/security/blog/2015/06/29/governmen... 2022: Microsoft Can Kiss My A* | Do You Own Your PC? [Smart App Control] https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s The Trojan Platform Module (TPM)
- aplanas 4y ago
  The common component here is Microsoft, not the TPM.
FridayoLeary 4y ago
Agreed. For proof, just look at how so much anti virus software can be considered malware in their own right.

vanderZwan 4y ago

So basically, Cory Doctorow's "The Upcoming War Against General Computation"? https://boingboing.net/2011/12/27/the-coming-war-on-general-purp.html https://boingboing.net/2011/12/27/the-coming-war-on-general-... https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip... Don't know enough about the subject to tell if his "attempts to control general computation will converge on rootkits" prediction has held up.

q-big 4y ago
To this talk, there exists a less well-known sequel: DEF CON 23 - Cory Doctorow - Fighting Back in the War on General Purpose Computers https://www.youtube.com/watch?v=pT6itfUUsoQ https://www.youtube.com/watch?v=pT6itfUUsoQ
- vanderZwan 4y ago
  Thank you for bringing this to my attention, will check it out after work
nibbleshifter 4y ago
> "attempts to control general computation will converge on rootkits" prediction has held up. If you play video games, you probably have a couple of neat kernel rootkits installed as "anti cheat". A lot of remote proctoring stuff for exams are looking a lot like rootkits too. EDR/XDR is also just rootkits. For security. The only thing that can stop a bad guy with a rootkit is a good guy with a rootkit, after all.
- agileAlligator 4y ago
  Kernel rootkits are going to be redundant pretty soon. There are cheats out there that use video captured by capture cards as input for an AI on a separate computer to actually play the game like a human would. Once that becomes widespread there is no way to stop it, save from banning capture cards entirely.
- mwint 4y ago
  The remote proctoring stuff is downright dystopian. I bought an extra laptop to do tests; most people can’t do that and have to install this garbage on their daily driver. Of course, I guess most people don’t care.
  - nibbleshifter 4y ago
    What's hilarious is it doesn't seem to prevent exam cheating in any meaningful way anyway, according to some students I've chatted to.
    - mwint 4y ago
      It really doesn’t. I took an exam in a meeting room at work with huge TVs on the wall… they made me show them the TVs were “unplugged”, so I just unplugged some random thing from the wall and they were happy. The TVs are hardwired, it’d be trivial to have an accomplice show answers or whatever on them.

ChuckNorris89 4y ago

Can you explain what is the issue with TPM? I get the issue with Pluton but TPM is only a dedicated and certified secure key and random number generator that does a better job than CPUs doing it in software, and it's also a secure enclave for storing your encryption keys. Would you rather store the keys in memory where they can be easily grabbed by malicious apps like Mimikatz? Macs had the same feature for years in the T2 chip. It's the exact system that enables wireless payment and other strong security features on your phone. So having TPM on PCs and using it for its interested purpose is a boon for everyone's security so I don't see the issue, just FUD.

furtiman 4y ago
Among that, the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration. Simplifying the description of the process a bit - at every bootup it checks the checksum of all programs loaded at every boot stage (UEFI, kernel, userspace) with respect to one that is known to be approved - process called "attestation". So in worst case, if your attestation server is very strict, any new binary installed on your machine will prevent it from booting or satisfying the attestation. This is the main concern that TPM enables.
- aplanas 4y ago
  > the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and "legit" (via PCR#10 extension). As you state later, it is this 3rd party the one that assert (verify) if you are state considered OK or not. Maybe I am too simplistic, but I do not see the evil in the TPM here, but only in the 3rd party policy. TPM can be abused but, as a developer, I am happy that we can use the TPM for good and fair goals in open source projects. It is the user who can decide to use the TPM or not, and should be noted that in the TCG specification it is stated that the TPM can be disabled and cleared by the user at any moment.

xjay 4y ago

2013: German Federal Government Warns on the Security Dangers of Windows 8 https://www.infosecurity-magazine.com/news/german-federal-government-warns-on-the-security/ https://www.infosecurity-magazine.com/news/german-federal-go... 2015: Governments recognize the importance of TPM 2.0 through ISO adoption https://www.microsoft.com/security/blog/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/ https://www.microsoft.com/security/blog/2015/06/29/governmen... 2022: Microsoft Can Kiss My A* | Do You Own Your PC? [Smart App Control] https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s The Trojan Platform Module (TPM)

aplanas 4y ago
The common component here is Microsoft, not the TPM.

FridayoLeary 4y ago

Agreed. For proof, just look at how so much anti virus software can be considered malware in their own right.