LUCHS.AT - Security - Trusted Computing is back to compromise your Systems

Do you recall the discussions about the Trusted Computing (TC) platform introduced several years ago? The idea was to introduce a trust relationship for code that gets executed on your own computing devices. Ross Anderson has explained the mechanism and its consequences in plain English on his personal web site in 2003:

…TC provides a computing platform on which you can't tamper with the application software, and where these applications can communicate securely with their authors and with each other. The original motivation was digital rights management (DRM): Disney will be able to sell you DVDs that will decrypt and run on a TC platform, but which you won't be able to copy. The music industry will be able to sell you music downloads that you won't be able to swap. They will be able to sell you CDs that you'll only be able to play three times, or only on your birthday. … TC will also make it much harder for you to run unlicensed software. In the first version of TC, pirate software could be detected and deleted remotely. … TC will protect application software registration mechanisms, so that unlicensed software will be locked out of the new ecology. Furthermore, TC apps will work better with other TC apps, so people will get less value from old non-TC apps (including pirate apps). Also, some TC apps may reject data from old apps whose serial numbers have been blacklisted. If Microsoft believes that your copy of Office is a pirate copy, and your local government moves to TC, then the documents you file with them may be unreadable. TC will also make it easier for people to rent software rather than buy it; and if you stop paying the rent, then not only does the software stop working but so may the files it created. So if you stop paying for upgrades to Media Player, you may lose access to all the songs you bought using it.…

The problems introduced by TC do not stop here. TC can help with remote censorship and hide malicious software from you. The latter is especially interesting since the discovery of state-sponsored malicious software found in Germany. There is no trust if you cannot control your own hardware. The architecture of the Trusted Computing platform merely takes control away from you and gives it to the hardware and software vendors. This is not a trusted computing platform and it opens up a whole set of questions. Given then fact that the third-party trust model has been broken by the security breaches of several certificate authorities (such as Comodo and DigiNotar).

So we strongly support making UEFI secure boot available to all users and not only to the consortium of the Trusted Computing Alliance.