With great power comes great responsibility - new attack type on Apple silicon

[Mark Kaine]

3 minutes ago, jagdtigger said:

I wouldnt call a black-box the right direction. The right direction would be to obliterate the "security through obscurity" mentality and the obsession with closed source sw.

Oh, I don't disagree,  thats part of what I meant with rethinking how programs/ computers work.

And you're right, ultimately closed source should perhaps be outlawed, because its always a big security/ privacy risk. I also keep saying OS must be modular, like theres so much legacy garbage in there now, let people decide what they want and from where...

 

[leadeater]

28 minutes ago, jagdtigger said:

I wouldnt call a black-box the right direction. The right direction would be to obliterate the "security through obscurity" mentality and the obsession with closed source sw.

How is a TPM a black box when it's an open standard and all the capabilities, algorithms, cypher standards are all known...

 

TPM is under BSD License

Quote

BSD licenses are a family of permissive free software licenses, imposing minimal restrictions on the use and distribution of covered software. This is in contrast to copyleft licenses, which have share-alike requirements. The original BSD license was used for its namesake, the Berkeley Software Distribution (BSD), a Unix-like operating system. The original version has since been revised, and its descendants are referred to as modified BSD licenses.

 

That's like saying data encryption is bad because it's a black box heh

[jagdtigger]

12 minutes ago, leadeater said:

How is a TPM a black box when it's an open standard and all the capabilities, algorithms, cypher standards are all known...

Havent seen the source code for the FW though, and if google cant find it i have my doubts....

[leadeater]

19 minutes ago, jagdtigger said:

Havent seen the source code for the FW though, and if google cant find it i have my doubts....

It's in the reference TPM Github

 

https://github.com/microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM

 

However it's BSD license, actual implementations can be freely modified and they are and obviously have to be to fit in with the CPU archecture they live within. That doesn't change that they have to actual adhere to the TPM spec otherwise nothing would work at all.

 

I suspect you only think they way you are because TPM can be used or be forced upon you in ways you do not like, which isn't the same thing as a black box. Good things can be used in bad ways or ways you don't agree with.

[porina]

2 hours ago, Mark Kaine said:

I don’t know I just think these things need to be rethought with security in mind primarily - I think the TPM chips are a thought in the right direction - not sure?

Easier said than done. These things were done for performance, and to not do them, or do them in a more secure way might lead to lower than currently expected performance. I don't mean a bit worse, but a LOT worse. Instead it has to be managed through the whole software and hardware layers. TPM only plays a small part of the overall picture.

[jagdtigger]

1 hour ago, leadeater said:

actual implementations can be freely modified and they are and obviously have to be to fit in with the CPU archecture they live within. That doesn't change that they have to actual adhere to the TPM spec otherwise nothing would work at al

You can have the world crappiest implementation and still be in compliance.... Call me paranoid but seeing how hard they are pushing it there is no question they have a hidden agenda behind it. It will be just like UEFI and """secure"""-boot. Some corp wanted to take control of HW they dont own and created a whole lot of headache in the process.....

[RejZoR]

4 hours ago, Mark Kaine said:

Viruses reached peak in 1994 :

 

 

"On Saturday, the 33nd anniversary of the building of the Berlin Wall, a likeness of the late East German leader popped up on thousands of computer screens in eastern and western Germany.

 

After the playing of the East German national anthem, computer programs were destroyed ″by order of the GDR (East German) Council of Ministers.″

 

″Honni’s last revenge - I’ll be back,″ was then displayed on screens."

 

More info:

https://groups.google.com/g/fido.ger.virus/c/mZtK_imKOuI

 

Also I swear I got that on my ATARI ST, not Windows 95... so a sophisticated multi attack vector trojan!!!

 

 

Its also not true that you had to delete any files, you only needed the right password  to remove it (which i sadly forgot)  but otherwise,  yeah, your computer remained locked... (i think the Atari one was more nasty)

 

Sadly cant find a picture... it was absolutely hilarious (and annoying lol)

 

Well, it seems similar, they also do that to save time obviously... I don’t know I just think these things need to be rethought with security in mind primarily - I think the TPM chips are a thought in the right direction - not sure? But then TPM has also already been compromised long ago, so yeah, its weird these vulnerabilities remain so persistent, I really think we need to rethink how programs,  and by large computers work to actually prevent these things (see the example above, stuff like trojans etc are ancient and hint at fundamental design flaws)

 

 

Huh? Sorry, but I just don't understand the point of this post. Also TPM does absolutely nothing on its own. In fact it does pretty much nothing even when paired with whatever to combat malware.

 

https://www.avast.com/technology/malware-detection-and-blocking#pc

https://www.avast.com/technology/ai-and-machine-learning#pc

 

Ignore it's Avast specific page, other companies use more or less similar approach and most of tech is nothing like what we've seen back in the 90's or even 2010's for some.

[Mark Kaine]

42 minutes ago, RejZoR said:

Sorry, but I just don't understand the point of this post.

it was in jest, showing that this isn't a new problem at all but rather systemic.

 

42 minutes ago, RejZoR said:

Also TPM does absolutely nothing on its own. In fact it does pretty much nothing even when paired with whatever to combat malware.

That might be, they're still pushing the "security" (integrity) angle hard... no one really knows, but its highly sus and seems almost yet another attempt to control the user foremost instead of protecting. 

 

2 hours ago, porina said:

Easier said than done. These things were done for performance, and to not do them, or do them in a more secure way might lead to lower than currently expected performance

Yah, I know,  Im just saying they'd need to start from scratch basically,  but i don't know if this can be solved with "software" alone or if there would need to be new hardware as well (such as "qbit" processors and whatnot) 

I do think many issues could be solved with a radically different OS approach though,  like seriously complete abandonment of "security through obscurity" for starters. 

[BuckGup]

On 4/30/2022 at 3:52 AM, emosun said:

But i was told apple doesn't get viruses.

Are we to believe apple just makes.......... regular computers with the same problems as every other computer?

Yes we have all heard the macs don't get viruses cliche joke but this isn't comparable at all to what you are saying