How to verify boot firmware integrity if you prioritize neutralizing Intel ME?

> Then the question becomes, what do you personally do to protect your computers boot firmware?

I have a multi-stage strategy.

First and most important, physical security. My computer is valuable enough that if I left it unattended in public, someone would probably nick it and put it on ebay. So I only leave it unattended in places with good enough physical security.

Secondly, I avoid doing anything that would impose spy-thriller-movie-level security requirements on my equipment. My employer wants to secure a critical code signing key? I'll be happy to sort them out with their own HSM in their own properly secured data centre, or their own USB stick in a bank vault, or whatever their requirements dictate. My personal security research? I anonymously publish anything interesting I find right away. And I strictly avoid going to countries where I think the government ought to be overthrown.

Therefore, the chances of an attack targeting my boot firmware are exceptionally small.

Finally, I embrace the reality that the TPM wouldn't have helped me anyway. Firstly the security the TPM offers depends on the security of the BIOS, and we all know that's a joke. Secondly, even if the TPM worked perfectly and the BIOS was secure and so on, an attacker in a position to mess with my firmware could just as easily install a physical keylogger, or a hidden camera pointing at my keyboard, or just have masked goons hit me with a $5 wrench until I tell them the password.

You have to understand that if you don't need this kind of security on your computer, the question wasn't addressed to you.

"just don't do risky stuff on it" doesn't cut it for those who need it.

Leave room for real discussion about the topic.

I'm not saying you shouldn't do risky things.

I'm saying you shouldn't do things so risky that a squad of spies would get sent to monitor you, learn your routine, pick your house's locks while you're at work, sneak in, dismantle your computer, image your encrypted hard disk, overwrite the bootloader with a special version that will record the FDE password next time you enter it and send it to them, reassemble your computer and sneak out undetected.

Because that's what an "evil maid attack" means, once you've got basic physical security in place.

As I'm not Ross Ulbricht or Julian Assange, I'm willing to take my chances.

I don't think it's such an rare adversary to have. Organized crime can easily have several experienced hackers in their "organization". It's common knowledge that gangs actually do monitor peoples routines who are inside their territory and they do it for several reasons, one of them being to rob your apartment or do an evil maid attack on your computer.

It's also common knowledge that all adversaries view people who have higher security than the average person as a person of interest or a mark. If they are spies they think you don't need privacy if you have nothing to hide and if you are trying to hard to hide then you must have something important to hide. Criminals think if you have security then you must have something valuable to protect.

Also some of the methods described her this thread seem impractical and extreme but one you go down this rabbit hole of security and privacy, you become used to gradually putting in a little more extra effort for better security and privacy. Normal users can't understand how someone can survive with having to toggle scripts on/off with the noscripts extension but for most people who are interested in security and privacy that is easy and effortless like breathing air.

My bigger question would be why do you need to verify boot firmware? If we know your goal, maybe there is a better way.

Tbh, I for myself would not care for physical intrusion. If someone (private or state sponsored) has the willingness to intrude into my home, them tampering with my PC is the least of my concerns. As someone else also mentioned: A $5 wrench will be more effective than any measures you can do by modifying your pc.

Regarding tamper evidence, there have been multiple Defcon / Blackhat talks about tamper evidence. One thing that comes into mind is vacuum sealing a notebook into a bag with colored beans and taking a photo. This way, it will be impossible to access the pc without disturbing the pattern of beans surrounding the PC. You just need the software to compare photos to know if the sealed bag has been tampered with.

What do you do if the beans are disturbed? Throw the laptop out presumably? Would it not be easier to not ship the laptop, instead buying a thin client locally?

imho the method is sound and consequences are separate topic

"That is left as an exercise for the reader"

That methods goal is to be tamper evident. You are referring to tamper proofing which opens up another whole can of worms.

> when you use me_cleaner to neutralize intel ME, it also removes TPM.

s/TPM/fTPM/

Some laptops have a discrete pTPM in addition to the ME's firmware TPM, which can be used for firmware validation, disk encryption, etc.

Some OEMs can detect when the chassis is opened, e.g. HP TamperLock, https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-8167ENW.pdf

This reminds me of my casino days. For slot machines each has several seals and the firmware and OS were checked each time anything was changed. We used a machine from a company called Kobetron for the EEPROMS but later the check was the OS on a disk. Seals were two layer foil with TAMPER when pulled off or a plastic tab that had a wire embedded in it.

One trick is to weld the case shut (you can get a welder on amazon for ~$100). This makes it much harder to open, especially in a non-tamper-evident way. You can open the case back up by using an angle grinder with a cutting disc to slice through the weld.

I'd recommend taking a very high res photo of the welds so you can compare later if tampering is suspected.

> Another idea is a container for the computer. The container can of course be destroyed easily but then you will at least know they did something with the computer. But you would need a container that the evil maid can't go get a duplicate of or have one manufactured so they can replace the container after destroying original one.

What's the goal here? Why can't the same super-powered evil maid just create a visually-identical replica of your entire computer, login UI included, then MITM your password / unlock sequence ?

Then go through your original computer at their leisure with the captured password, while you ponder why "your" computer just crashed after login...

If we have a container that is tamper evident then they can't do all those computer modifications you mentioned without we finding out the computer has been tampered with.

It's not a modification, it's a clone. Does your container allow operating the computer (even when locked)? Because operating the computer is all that I need to be able to make a visually identical replica right until the logon screen.

Maybe I misunderstand you what you mean with a clone of the computer. Do you mean take my entire computer and replace it with a completely different computer that is the same model? Because if that is what you mean then they can't clone the tamper evident container because then it wouldn't be tamper evident. Glitter nail polish for example couldn't be cloned because the pattern would be different on the second computer which is the clone.

Or do you mean to do everything on my computer without having access to any hardware/firmware? You would just simply boot up the computer and somehow hack it? How?

> Another idea is a container for the computer. The container can of course be destroyed easily but then you will at least know they did something with the computer. But you would need a container that the evil maid can't go get a duplicate of or have one manufactured so they can replace the container after destroying original one.

There was an article [0] posted some days ago, they reccomended a transparent container and a mixture of red and brown lentils, and work just as with the glitter nail polish.

[0] https://www.anarsec.guide/posts/tamper/

"Perfection is the enemy of good" also applies here, imho. If you need one specific machine and cannot work without it, well I guess there's not much more you can do than the nail polish trick. But if you "just" need a safe compute environment and store your sensitive data off site (in whatever secure way you prefer), burner machines probably work best. Don't travel with your data at all, buy a cheapo early Secure Boot laptop on arrival (an X220-era Thinkpad or something like a C720P Chromebook), install whatever distro you prefer with your own Secure Boot keys enrolled and a signed kernel and feel free to access your remote data from your freshly installed secure 100$ laptop. A ton of early Chromebooks can be Corebooted for extra purity (with an easy script from MrChromebox) so you can go from vanilla Chromebook to Coreboot + custom keyed Secure Boot + distro of choice in half an hour!

Do you mean to use VNC to access your data? Because that sounds very difficult to secure and also do maintenance when you are never onsite. The host computer that has your data would have same problems as what this topic is about but now you can't even check for tamper evidence because you are not onsite.

Or do you mean to encrypt your data and upload to the cloud? Then download the data when you need to use it? And how are you managing all the passwords and encryption keys? I think you would need to keep quite a bit of sensitive data on that travel computer so you would need tamper evidence on it as well.

Or I think I must be completely missing out on something here what you are saying. Maybe you can elaborate a bit? It sounds interesting.

You cannot protect hardware, just the things that flow through it, for a brief time.

Buy a random older computer with cash. Nothing critical needs more than 512mb anyway.

Faraday caged, WIFI/Bluetooth/EM sensitive heartbeat monitors, decentralized fail-safe Live feeds,full air gapped setup with UPS, white-noise machines, and only transmit data via QR codes.

Hope the monitor you chose to display QR and the web-camera are also faraday'd.

Hope the computer you are using to display the QR never gets compromised, and the QR-code reader, at the same time.

It's easier to send a squid-team with a $5 wrench.

The validation you lose is close to worthless in any sense because attackers that could get past your glitter nail polish can replace your computer's innards. even so far as replacing your computer with a networked KVM that pilots your computer at a distant location so you can type in your passwords, etc.

They first have to get through the glitter nail polish protection without evidence. That's the point of the glitter nail polish, tamper evidence.

resocket your chipset so you can pop it out and take it with you.

I use Heads with TPM and Librem Key (with my own keys) just fine on my Librem 14 with neutralized ME.

The post is about the scenario where you disabled the TPM

I don't see it. The post says "when you use me_cleaner to neutralize intel ME, it also removes TPM", which is just not true for my system.

I made a mistake when I wrote the post mixing up disable and neutralized but I hoped everyone would understand I'm talking about disabling it.

My Librem 14 has disabled ME; my Librem 15 has both disabled and neutralized ME. Both with Heads, TPM and Librem Key. I don't understand how the difference between disabled and neutralized matters here.

Yeah I didn't know it was possible because some laptops have the TPM in a seperate chipset than the one that has intel me. I thought they only set the hap bit to neutralize but I learned here that they can also disable it on laptops that have TPM on a 2nd chipset.

Librem laptops have a TPM separate from Intel ME. The post is about if you have nuked the TPM built into the Intel ME. I'd say "have separate TPM" is a viable alternative.

The correct answer is coreboot+heads