Instructor: Trusted Firmware. 2 2
In this lesson, we're going to talk about 3 3
a handful of different types of things 4 4
that we use within Trusted Firmware. 5 5
This is going to include seven different items. 6 6
Now, as I talk about Trusted Firmware 7 7
we have to think about the idea of a firmware exploit 8 8
because we're trying to prevent firmware exploits 9 9
by using Trusted Firmware. 10 10
Now, a firmware exploit is going to give an attack 11 11
or an opportunity to run any code 12 12
at the highest level of CPU privilege. 13 13
Because if you're at the firmware, 14 14
for instance, in the BIOS or the UEFI, 15 15
you can actually have essentially a root kit 16 16
that runs over the entire system 17 17
and that's loaded even before Windows is, 18 18
so your antimalware is not going to find it. 19 19
Now, when we talk about these different Trusted Firmwares, 20 20
there's lots of different terms we have to cover. 21 21
This includes things like UEFI, 22 22
the Unified Extensible Firmware Interface, 23 23
Secure Boot, Measured Boot, attestation, 24 24
eFUSE, Trusted Firmware updates, and self-encrypting drives. 25 25
As we go through this lesson, 26 26
we're going to talk about each of these seven. 27 27
The first one is the Unified Extensible Firmware Interface, 28 28
or U-E-F-I. 29 29
This is a type of system firmware 30 30
providing support for 64-bit CPU operations at boot. 31 31
It also gives you a full GUI and mouse operations 32 32
at boot and better boot security. 33 33
To be able to run a lot of the other things 34 34
we're going to talk about in this lesson 35 35
you have to have UEFI and not BIOS for your system. 36 36
The good news is most systems nowadays, 37 37
in fact I think almost all of them, 38 38
will use UEFI and not BIOS. 39 39
If you're using BIOS on a system, 40 40
it's most likely a legacy device that is several years old. 41 41
Now, the first thing we want to talk about inside of UEFI 42 42
is this idea of a Secure Boot. 43 43
This is a feature of UEFI that prevents unwanted processes 44 44
from executing during the boot operation. 45 45
Essentially, as a computer is booting up 46 46
it's going to check things 47 47
and make sure that there's digital signatures installed 48 48
from those operating system vendors. 49 49
If Microsoft Windows isn't signed by Microsoft, 50 50
we're not going to boot it. 51 51
That's the idea of Secure Boot. 52 52
We want to make sure that the boot loader 53 53
is only loading things that are valid 54 54
and not loading malware. 55 55
The next thing we have is what's known as a Measured Boot. 56 56
Now, a Measured Boot is a UEFI feature 57 57
that gathers secure metrics to validate the boot process 58 58
in an attestation report. 59 59
So as you're booting up, 60 60
it's going to be taking different measurements. 61 61
How much time does it take for you to do this? 62 62
How much process does it take to do that? 63 63
And based on that, it's going to collect that data, 64 64
It's going to create a report, 65 65
and then it's going to attest to it. 66 66
Which brings us to the idea of attestation. 67 67
Now, attestation is a claim 68 68
that the data presented in a report is valid, 69 69
and it does this by digitally signing it 70 70
using the TPM's private key. 71 71
So the UEFI is going to take that report, 72 72
it's going to sign it with that digital key, 73 73
and then send it on to the operating system 74 74
and to the processor. 75 75
This way, we know we can trust it. 76 76
Now, the next thing we need to talk about 77 77
as far as Trusted Firmware goes 78 78
is the concept of eFUSE. 79 79
Now, eFUSE is a means for software or firmware 80 80
to permanently alter the state 81 81
of a transistor on a computer chip. 82 82
Now, this comes from the idea of a fuse. 83 83
If you've ever worked with electricity before 84 84
and you've worked in a breaker panel 85 85
you may have seen things like these. 86 86
These are fuses. 87 87
Notice on the left, we have four fuses that are good, 88 88
they have a straight line going through them. 89 89
But the fifth one is actually a blown fuse. 90 90
This means there is too much power that went through 91 91
and that wire actually got broken. 92 92
You can see it physically there that the wire is broken 93 93
and there's kind of that burntness to it. 94 94
You can't go back and replace this fuse 95 95
back to looking like the ones on the left. 96 96
It's going to be permanently and altered forever. 97 97
That's the same idea here with an eFUSE. 98 98
An eFUSE is an electronic fuse. 99 99
It essentially uses one time programming 100 100
that's used to seal these cryptographic keys 101 101
and other security information 102 102
during the firmware development process. 103 103
If somebody tries to mess with that 104 104
it will actually blow that fuse, 105 105
making that product, that firmware, 106 106
no longer valid or trusted. 107 107
The next thing we want to talk about 108 108
is Trusted Firmware updates, 109 109
because we have to update our firmware over time. 110 110
So when we have a Trusted Firmware update, 111 111
this is a firmware update that is digitally signed 112 112
by the vendor and trusted by the system 113 113
before it's installed. 114 114
Anytime you're going to go and do a firmware update 115 115
you need to make sure that it is trusted, 116 116
because if it's trying to do something that's not trusted 117 117
you have the potential to blow one of these eFUSES 118 118
that we just talked about. 119 119
And the final concept with Trusted Firmware 120 120
is a self-encrypting drive. 121 121
Now, we've talked about self-encrypting drives before. 122 122
These are disk drives where the controller 123 123
can automatically encrypt the data that is written to it. 124 124
Now, why are we talking about self-encrypting drives 125 125
when we're talking about Trusted Firmware? 126 126
Well, because these drives have firmware 127 127
to run that encryption process. 128 128
That is software on a chip and that is what firmware is. 129 129
And so we need to make sure that the firmware 130 130
on these self encrypting-drives is trusted 131 131
and it follows a lot of these same basic principles 132 132
that we've talked about through this lesson. 133 133
The idea with these self-encrypting drives 134 134
is that they have firmware on them 135 135
that is used to do the encryption 136 136
when data is being written to the drive. 137 137
It also decrypts that information 138 138
when data is being read from the drive. 139 139
All of this is done at the hardware level, 140 140
so it takes the processing load off of your own computer 141 141
and off of your operating system, 142 142
'cause it's all done here in the firmware.