"The BadRAM attack – which does require physical access to hardware"
so...academically "blown wide open" but for anyone with a cogent opsec, probably not the end of the world.
so...academically "blown wide open" but for anyone with a cogent opsec, probably not the end of the world.
I have my doubts whether this can ever work reliably. It seems risky to bet a lot of infrastructure investment on the fact that attacks like this one (or even better ones) do not happen. But the entire hypervisor business has the same structural problem (a bad CPU bug like the T-Head C910 vector issue could turn your hypervisor fleet into very expensive single-tenant machines over night), and yet here we are …
A TEE restricts attackers to nation-state and similar actors today, and is probably no hurdle at all in 5-10 yrs when some attack like this is published and the hardware is unpatchable.
I don’t get the impression these classes of attacks will ever be patchable.
Is supposed to. Because money are sweet. Physical access means that you can exchange any part of your system and the bloody TEE would have no idea that it is MITM.
You should care also about democratic countries. For your own good.
This is in theory. In practice, as demonstrated by the article, these assurances are not bulletproof.
So I was referring to the case where there exists an entity that has some equivalent of "private keys" that makes it possible to control the TEE/attestation..
I would think as long as the manufacturer and the operator are not the same entity then the danger in that regard would be mitigated.
What is the TEE supposed to buy you over this? Avoiding the negligible inconvenience of typing the long passphrase once a month if you don't have a remote server, which the enterprises that demand features like this would have? That seems like more of a solution in search of a problem and in any event not worth the cost in authoritarianism.
Not only that, the TEE solution is less secure. If the device is stolen and you revoke access on the remote server then there is no way for an attacker with only the device to get the key. If the key is in a TPM on the device they can stick the device in a drawer and wait until someone finds a TPM vulnerability, then unlock it.
a) they can attack it before it reboots.
b) most of the value is in the parts, so they don't need your data. You need to make the parts useless for repairs so it's not worth stealing it.
But they can do that anyway? If they would guess your password or exploit your OS from the lock screen then they get access to your files even if the running OS is the one certified by the hardware.
> most of the value is in the parts, so they don't need your data. You need to make the parts useless for repairs so it's not worth stealing it.
Putting aside that "make the parts useless for repairs" is an obvious misfeature that will be used against you by the manufacturer, it's also orthogonal to boot loader signing etc.
Making the parts "useless for repairs" would also be better achieved by making new and used repair parts available for competitive prices, driving down the cost of repairs to the point that stealing devices for repair parts isn't a lucrative endeavor. For example, make sure that traded-in devices never get crushed if they could be scavenged for parts to be sold into the repair market, providing a plentiful supply of used parts instead of making them scarce enough to be worth stealing.
So on some systems, the hack could be performed entirely remotely.