Feasibility Study: Authenticated PC Firmware on the Cheap
No ratings
Presented at BSidesWinnipeg 2015 by
If you want to authenticate that a PC's firmware and boot loader are unaltered, hardware based solutions such as trusted platform module (TPM), Intel boot guard, Intel Platform Trust Technology (PTT) and AMD equivalents probably come to mind. Such contemporary hardware features may not be affordable, available, or trusted. An approach that works on older computers acts as a hedge, available if hardware makers become malicious and as additional competitive discouragement for them to do so and undermine general-purpose computing as we know it. We assess the feasibility for the following soft approach: 1) A special boot verifier is loaded from secondary storage by firmware 2) Over a local connection, a trusted second computer sends random parameters for a difficult hashing problem to the boot verifier, this problem requires the contents of firmware and boot relevant parts of secondary storage as inputs and demands the entirety of RAM be utilized 3) Solutions at particular checkpoints to the hashing problem are transmitted to the second trusted computer 4) The secondary computer verifies not just the correctness of all solutions, but their timing of transmission against an established benchmark for the machine tested. For older x86 hardware without virtualization extensions (where hardware access for transmission can introduce a significant performance penalty), the idea is that any attempts at virtualization or hiding a malicious payload with the help of paging will show a detectable performance hit on timing. The threat model is an attacker who can only alter the firmware, boot loader, and boot verifier code loaded from secondary storage. The attacker is assumed to not be able to make hardware modifications undetectable to inspection, including overclocking and installation of transmitters to offload the hashing problem. This is for local (non-remote) attestation only. We have written a prototype for a non-SMP x86 computer and tested problem parameters that produce timing detectable results under a hypervisor/virtualizer and assess if these parameters are feasible for practical use.