Craig discusses the uses of TPM in securing Windows and Linux
For more tech tips, news, and updates, visit – CraigPeterson.com
—
Trojan Malware Targets Trump Supporters
Nmap 7.90 released: New fingerprints, NSE scripts, and Npcap 1.0.0
Tyler Technologies finally paid the ransom to receive the decryption key
5G in the US averages 51Mbps while other countries hit hundreds of megabits
Apple’s T2 security chip has an unfixable flaw
Verizon Payment Security Report is a Wake-up Call: Time to Refocus on PCI DSS Compliance
Android Ransomware Has Picked Up Some Ominous New Trick
—
Automated Machine-Generated Transcript:
Craig Peterson: [00:00:00] We’re going to delve now into the idea behind keeping your data safe on your disks and what are the different regulations about it? Cause there’s a few right now that you need to know about.
Hi everybody. Welcome back, Craig Peterson
We’re talking today, at least this hour about security because of a major security problem that was announced this week, about Apple’s security chip, the T2 chip. not a very good thing, frankly and so going through all of this right now and we’re going to move upscale just slightly here.
I love this quote here. It was in ARS Technica this week, and it is from a gentleman who worked for the NSA his name’s Patrick Wardle. He’s an Apple security researcher at the enterprise management firm JAMF JAMF. I’ve talked about them on the show before they have some great management software.
He’s also a former NSA researcher. And he said I had already assumed that since T2 was vulnerable to CheckM8 Check M eight. It was toast.
He said, okay, there really isn’t much that Apple can do to fix it. It’s not the end of the world, but this Chip, which was supposed to provide all this extra security is now pretty much moot. So it’s, an interesting time here.
Wardle points out that for companies that manage their devices using Apple’s activation lock and find my features, the jailbreak could be particularly problematic, both in terms of possible device theft and other insider threats. He knows that the jailbreak tool could be a valuable jumping-off point for attackers looking to take a shortcut to develop potentially powerful attacks Quote you likely could weaponize this and create a lovely in-memory implant that by design disappears. On reboot. By the way, that is a very common method now for much of the smell where it’s memory resident, there’s no sign of it on disc. It never hits the disc. So your antivirus software, ain’t gonna find it because when it scans the disc, it’s just not there. It’s just amazing. So the bottom line here is building in hardware security mechanism is always a double-edged sword. That is true, not just of the Apple side, but over on the windows side and the union Linux sides, there’s something called a trusted platform module also called TPM. This is an ISO standard here. It’s standard for a secure cryptoprocessor. Just like that T2, it is a processor. It is a computer and it’s designed physically to be almost impenetrable. I call it elephant snot. It’s that really hard epoxy that they put onto the chips so that you can’t get into the chip without destroying it. There are other methods for it as well, to try and keep that data safe.
But it’s been around now for quite a few years, the most recent edition of it came out in about 2016. There’ve been a few errata, but it is designed to have a hardware, random number generator. Now that’s important because having a secure cryptographic key, it means you have to have a very good source to generate that key with, and that means a very good, random number generator. Most processors aren’t that great, man. I could talk for hours about the problems we’ve had over the years of these types of things. That’s the whole idea behind the trusted platform module. It can also store those keys. It can also identify itself and the computer uniquely, which is very handy when you are trying to log in, you can use the TPM to help to identify the machine. It has bind keys. It’s public key cryptography. It’s an RSA key and ceiling as well. So it allows the TPM to be used or not be used. I’m trying to keep this pretty simple. Department of Defense is now specifying that all new computer assets that are purchased by the DOD must include a TPM or a trusted again remember platform module that is version 1.2 or higher. There are details on that. You can look those up, but I’ve gotten to say no matter who you are, what business you’re in, you really should make sure the computer you buy has a TPM in it. Now we have seen security problems with TPMS by certain vendors. They’ve fixed them, just like this T2 problem with Apple. I’m sure it’ll be fixed. By the way, the T1 chip from Apple does not have this problem, it’s just the T2 chip, but the whole TPM is really there to help ensure the integrity of the platform. In other words, the operating system, the hard desk, the encryption for the heart.
So if you’re using BitLocker on Windows, it works best with a TPM. So BitLocker and windows will encrypt the desk using the key that is generated by and stored in the TPM on the machine.
So write that one down and in my cybersecurity mastery course. We talk about BitLocker and how to use it and TPMs and how to just select those.
Also nowadays, you’re going to find the newer computers no longer have bios in them. You probably already figured that one out. Most of you guys, right? You are the best and brightest out there. But they have UAF, I mentioned earlier, that’s the unified extensible firmware phase to boot.
So the UEFI works with the TPM to create this kind of circle of trust crust if you will. It’s absolutely phenomenal. So Linux has its own little thing called the unified keys set up. I already mentioned BitLocker’s private core and various other things. Full disk encryption. Very important.
There are utilities to do that again on Apple. It’s very easy to set up full disk encryption in all these cases here where you should be using your TPM or T2 chip in order to do that. The authentic catered mechanism. It just me authentication mechanism in. The software can be hacked in hardware.
Usually can’t be hacked. What have we just been talking about for the last half hour? yeah. Hacking the hardware. But that’s what the TPMS is all about. That’s what gene to do. There’s discreet, TPMS, there’s TPMS that are built right onto the motherboard. And, there are also some that run as software-only solutions inside the CPU itself.
That’s part of their trusted execution environment. Not really fond of those. But now, you know what to look for. There are other things as well that we go through a lot of other things in the cybersecurity mastery course. But, one more thing before we go. And that is we talked about encryption on the hard disk level.
So the physical hard disk itself can have encryption, which is great, but that encryption is really only useful for when you are getting rid of that disk. So you destroyed the key by removing a jumper or shorting out a jumper and now that disks data is effectively destroyed. And the disk can actually be reused again.
Certain standards, federal government standards. we have a system that literally melts the aluminum platters right down. It’s Kiln. I forgot what you call these things, but a very hot, yeah. Over a thousand degrees, but for a regular business computer, you’re not going to have to worry about that.
You need to also have a TPM and make sure that on top of that you are using BitLocker or some other type of encryption. And when you get. Way up there into the CMMC as part of the department of defense standards or the 800-171 standards from NIST, then you have to have special key management remotely that has a different key for every desk.
And it gets pretty complicated pretty quickly, but the whole idea is to secure your data and remember. Just because it’s all encrypted doesn’t mean it’s safe from hackers.
We should talk about that at some point, but when we get back, we’re going to talk about, but our final two final do articles of the day, listening to Craig Peterson, and you’ll find me online at craigpeterson.com.
—
More stories and tech updates at:
Don’t miss an episode from Craig. Subscribe and give us a rating:
Follow me on Twitter for the latest in tech at:
For questions, call or text:
855-385-5553
