3 ms·

What do you mean? Ship computer with preinstalled Linux that you can't tamper? Sounds like Android. For ordinary computers, secure boot is fully configurable, s

What do you mean? Ship computer with preinstalled Linux that you can't tamper? Sounds like Android. For ordinary computers, secure boot is fully configurable, so it won't work: I can disable it, I can install my own keys, etc. Any for any userspace way to check it I'll fool you, if I own the kernel.

tapoxi 10mo ago
No, just have the anti-cheat trust kernels signed by the major Linux vendors and use secure boot with remote attestation. Remote attestation can't be fooled from kernel space, that's the entire point of the technology. That way you could use an official kernel from Fedora, Ubuntu, Debian, Arch etc. A custom one wouldn't be supported but that's significantly better than blocking things universally.
- digiown 10mo ago
  You can't implement remote attestation without a full chain of exploits (from the perspective of the user). Remote attestation works on Android because there is dedicated hardware to directly establish communication with Google's servers that runs independent (as a backchannel). There is no such hardware in PCs. Software based attestation is easily fooled on previous Android/Linux.
  - tapoxi 10mo ago
    The call asks the TPM to display the signed boot chain, you can't fake that because it wouldnt be cryptographically valid. The TPM is that independent hardware.
    - digiown 10mo ago
      How would that be implemented? I'd be curious to know. I'm not aware that a TPM is capable of hiding a key without the OS being able to access/unseal it at some point. It can display a signed boot chain but what would it be signed with? If it's not signed with a key out of the reach of the system, you can always implement a fake driver pretty easily to spoof it.
      - tapoxi 10mo ago
        This is called the Endorsement Key, and you're correct, it never leaves the TPM. The TPM is a "black box" to the OS.
        digiown 10mo ago
        Ah, got it. With enough motivation this is still pretty easily defeated though. The key is in some kind of NVRAM, which can be read with specialized equipment, and once it's out, you can use it to spoof signatures on a different machine and cheat as usual. The TPM implementations of a lot of consumer hardware is also rather questionable. These attestation methods would probably work well enough if you pin a specific key like for a hardened anti-evil-maid setup in a colo, but I doubt it'd work if it trusts a large number of vendor keys by default.
        tapoxi 10mo ago
        Once it's out you could but EKs are unique and tied to hardware. Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool, and would only ever work for one person. It also means that if you do get banned for any reason (obvious cheating) they then ban the EK and you need to go source more hardware. It's not perfect but it raises the bar significantly for cheaters to the point that they don't bother.
        digiown 10mo ago
        > Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool The idea is you implement a fake driver to sign whatever message you want and totally faking your hardware list too. As long as they are relatively similar models I doubt there's a good way to tell. Yeah, I think there are much easier ways to cheat at this point, like robotics/special hardware, so it probably does raise the bar.
        fc417fc802 10mo ago
        Any sane scheme would whitelist TPM implementations. Anyway fTPMs are a thing now which would ultimately tie the underlying security of the anticheat to the CPU manufacturer.

tapoxi 10mo ago

No, just have the anti-cheat trust kernels signed by the major Linux vendors and use secure boot with remote attestation. Remote attestation can't be fooled from kernel space, that's the entire point of the technology. That way you could use an official kernel from Fedora, Ubuntu, Debian, Arch etc. A custom one wouldn't be supported but that's significantly better than blocking things universally.

digiown 10mo ago
You can't implement remote attestation without a full chain of exploits (from the perspective of the user). Remote attestation works on Android because there is dedicated hardware to directly establish communication with Google's servers that runs independent (as a backchannel). There is no such hardware in PCs. Software based attestation is easily fooled on previous Android/Linux.
- tapoxi 10mo ago
  The call asks the TPM to display the signed boot chain, you can't fake that because it wouldnt be cryptographically valid. The TPM is that independent hardware.
  - digiown 10mo ago
    How would that be implemented? I'd be curious to know. I'm not aware that a TPM is capable of hiding a key without the OS being able to access/unseal it at some point. It can display a signed boot chain but what would it be signed with? If it's not signed with a key out of the reach of the system, you can always implement a fake driver pretty easily to spoof it.
    - tapoxi 10mo ago
      This is called the Endorsement Key, and you're correct, it never leaves the TPM. The TPM is a "black box" to the OS.
      - digiown 10mo ago
        Ah, got it. With enough motivation this is still pretty easily defeated though. The key is in some kind of NVRAM, which can be read with specialized equipment, and once it's out, you can use it to spoof signatures on a different machine and cheat as usual. The TPM implementations of a lot of consumer hardware is also rather questionable. These attestation methods would probably work well enough if you pin a specific key like for a hardened anti-evil-maid setup in a colo, but I doubt it'd work if it trusts a large number of vendor keys by default.
        tapoxi 10mo ago
        Once it's out you could but EKs are unique and tied to hardware. Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool, and would only ever work for one person. It also means that if you do get banned for any reason (obvious cheating) they then ban the EK and you need to go source more hardware. It's not perfect but it raises the bar significantly for cheaters to the point that they don't bother.
        digiown 10mo ago
        > Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool The idea is you implement a fake driver to sign whatever message you want and totally faking your hardware list too. As long as they are relatively similar models I doubt there's a good way to tell. Yeah, I think there are much easier ways to cheat at this point, like robotics/special hardware, so it probably does raise the bar.
        fc417fc802 10mo ago
        Any sane scheme would whitelist TPM implementations. Anyway fTPMs are a thing now which would ultimately tie the underlying security of the anticheat to the CPU manufacturer.