How Windows 10 Rewrites OS Architecture: Battle of SKM and IUM [pdf]

http://www.alex-ionescu.com/blackhat2015.pdf

by transpute • 11 years ago

59 26 11 years ago

narrator• 11 years ago

Maybe I'm being cynical, but I'm expecting a day when all this security backfires and you have to throw out your computer when you get attacked by certain malware that gets inside of these trusted computing areas. The part about not being able to read certain memory areas, even with hardware access, is especially disturbing.

pixelcort• 11 years ago

We already have consoles, smart devices, etc that can sometimes get bricked, so we're already halfway there.

venomsnake2• 11 years ago

It is all about DRM. Make no mistakes. They want to turn PC into Consoles. And the effort is underway.

Unless MS provide way to build and sign your copy of windows yourself. As with any other tech - the important thing is who holds the keys.

josteink• 11 years ago

As with any other tech - the important thing is who holds the keys.

I may not agree with your whole post, bit this is key.

It's about control of your own hardware and it's gradually being taken away. One piece at a time.

mjg596• 11 years ago

The root of trust is in Secure Boot, and you have control of those keys. That means you maintain control of your machine - it's always possible for you to boot modified code that checks your signatures instead of any manufacturer's.

keyboardwarrior• 11 years ago

Lets not fool ourselves into thinking this is about security. We are talking about microsoft here.

its not like they would ever break anti-trust...

TazeTSchnitzel• 11 years ago

This is possible today with firmware rootkits.

kevin_b_er• 11 years ago

It isn't your computer anymore. The device no longer trusts YOU and will not obey you. It obeys its owners: The corporation that made it.

Therefor your point is moot. It isn't your device, so you aren't throwing out anything you own.

transpute• 11 years ago

Reddit discussion (68 comments) on Skylake SGX enclaves, which will bring similar concepts to other x86 operating systems, https://www.reddit.com/r/hardware/comments/3nn33x/intel_to_b...?

mjg596• 11 years ago

The discussion about enforcing Secure Boot is kind of missing the point - if Secure Boot isn't enabled, earlier code could simply pass a fake pointer to the EFI runtime services table and fake GetVariable(), making it look like Secure Boot is enabled and appropriately configured. There's no real programmatic way to verify that Secure Boot is enabled[1], you pretty much just have to assert that it is.

[1] Well, kind of. The Secure Boot configuration state is measured into PCR 7 on the TPM, so you can seal a secret to it and then have it fail if the Secure Boot configuration changes. But that's made difficult because updates to dbx (but not dbt) invalidate the state, so you need a lot of very careful handshaking in blacklist updates.

mjg596• 11 years ago

Huh that sounded far more negative than I meant. The rest of the discussion is excellent, and the functionality described is amazingly important.

aionescu• 11 years ago

Author here.

The problem I was trying to get to is that VSM allows itself to be activated without SB (which as you note, can also be done with malicious SB) and therefore there is no way to really 'trust' the VSM implementation.

Possible fixes to this would be to rely on SGX/TXT. But even that can be messed with -- but the attack surface is much harder than EDK-II.

How Windows 10 Rewrites OS Architecture: Battle of SKM and IUM [pdf]

Related Stories