[Infowarrior] - Blackhat Con presentation withdrawn

[Richard Forno]

This story appeared on Network World at
http://www.networkworld.com/news/2007/062707-black-hat.html

Integrity of hardware-based computer security is challenged
Withdrawn Black Hat paper hints at flaws in TPM security architecture

By Tim Greene, Network World, 06/27/07

A presentation scheduled for Black Hat USA 2007 that promised to undermine
chip-based desktop and laptop security has been suddenly withdrawn without
explanation.

The briefing, ³TPMkit: Breaking the Legend of [Trusted Computing Group¹s
Trusted Platform Module] and Vista (BitLocker),² promised to show how
computer security based on trusted platform module (TPM) hardware could be
circumvented

³We will be demonstrating how to break TPM,² Nitin and Vipin Kumar said in
their abstract for their talk that was posted on the Black Hat Web site but
was removed overnight Monday.

³The demonstration would include a few live demonstrations. For example, one
demonstration will show how to login and access data on a Windows Vista
System (which has TPM + BitLocker enabled),² the abstract said.

BitLocker is disk-encryption technology in Microsoft¹s Vista operating
system that relies on TPM to store keys.

In an e-mail, Vipin Kumar says, ³We have pulled back our presentation from Š
Black Hat. So, we won't be presenting anything related to TPM/BitLocker in
Black Hat. Š We would not like to say anything about the TPM/BitLocker for
the time being.² He didn¹t respond to inquiries about why the brothers
withdrew.

A spokesman for the conference was unable to offer more information. ³At
their request, they are no longer presenting. That is all the info I have,²
said the spokesman, Nico Sell, in an e-mail.

The conference brings together technically savvy security experts from
business, government and the hacking community to discuss the latest
security technologies. Frequently, Black Hat briefings become controversial
because they point out previously unknown weaknesses in products or
technologies.

The Kumars¹ promised exploit would be a chink in the armor of hardware-based
system integrity that TPM is designed to ensure.

TPM is also a key component of Trusted Computing Group¹s architecture for
network access control (NAC). TPM would create a unique value or hash of all
the steps of a computer¹s boot sequence that would represent the particular
state of that machine, according to Steve Hanna, co-chair of TCG¹s NAC
effort.

This initial hash of a known, trusted machine would be stored in the TPM and
compared to the hash that is created when that machine last booted up. As
part of TCG¹s NAC plan, if the hash values don¹t match, that indicates the
machine has been altered and might no longer be secure, says Hanna.

That check, known as remote attestation, would be part of decision making by
a NAC policy server. In their description of their talk, the Kumars said
they have developed a tool called TPMkit that bypasses remote attestation
andwould let a computer that is not in a trusted state gain access anyway.

At the Black Hat conference in Amsterdam earlier this year the Kumars
demonstrated a bootkit that can insinuate itself into the Vista kernel
without setting off Vista security alarms. At the time, the pair said they
thought TPM was the only way to ensure that unsigned code is blocked from
executing during the Vista boot sequence.

The Kumars live in India and run a security consulting firm called NV Labs.

All contents copyright 1995-2007 Network World, Inc.
http://www.networkworld.com