1 1 00:00:00,300 --> 00:00:02,040 Trusted Firmware. 2 2 00:00:02,040 --> 00:00:03,900 In this lesson, we're going to talk about 3 3 00:00:03,900 --> 00:00:05,880 a handful of different types of things 4 4 00:00:05,880 --> 00:00:08,370 that we use within Trusted Firmware. 5 5 00:00:08,370 --> 00:00:11,160 This is going to include seven different items. 6 6 00:00:11,160 --> 00:00:12,930 Now, as I talk about Trusted Firmware 7 7 00:00:12,930 --> 00:00:15,210 we have to think about the idea of a firmware exploit 8 8 00:00:15,210 --> 00:00:17,160 because we're trying to prevent firmware exploits 9 9 00:00:17,160 --> 00:00:18,570 by using Trusted Firmware. 10 10 00:00:18,570 --> 00:00:20,460 Now, a firmware exploit is going to give an attack 11 11 00:00:20,460 --> 00:00:22,260 or an opportunity to run any code 12 12 00:00:22,260 --> 00:00:24,810 at the highest level of CPU privilege. 13 13 00:00:24,810 --> 00:00:26,190 Because if you're at the firmware, 14 14 00:00:26,190 --> 00:00:28,290 for instance, in the BIOS or the UEFI, 15 15 00:00:28,290 --> 00:00:30,330 you can actually have essentially a root kit 16 16 00:00:30,330 --> 00:00:32,040 that runs over the entire system 17 17 00:00:32,040 --> 00:00:34,350 and that's loaded even before Windows is, 18 18 00:00:34,350 --> 00:00:37,230 so your antimalware is not going to find it. 19 19 00:00:37,230 --> 00:00:39,600 Now, when we talk about these different Trusted Firmwares, 20 20 00:00:39,600 --> 00:00:41,550 there's lots of different terms we have to cover. 21 21 00:00:41,550 --> 00:00:43,110 This includes things like UEFI, 22 22 00:00:43,110 --> 00:00:45,510 the Unified Extensible Firmware Interface, 23 23 00:00:45,510 --> 00:00:49,110 Secure Boot, Measured Boot, attestation, 24 24 00:00:49,110 --> 00:00:53,280 eFUSE, Trusted Firmware updates, and self-encrypting drives. 25 25 00:00:53,280 --> 00:00:54,510 As we go through this lesson, 26 26 00:00:54,510 --> 00:00:56,640 we're going to talk about each of these seven. 27 27 00:00:56,640 --> 00:00:59,700 The first one is the Unified Extensible Firmware Interface, 28 28 00:00:59,700 --> 00:01:01,170 or U-E-F-I. 29 29 00:01:01,170 --> 00:01:02,790 This is a type of system firmware 30 30 00:01:02,790 --> 00:01:06,900 providing support for 64-bit CPU operations at boot. 31 31 00:01:06,900 --> 00:01:09,300 It also gives you a full GUI and mouse operations 32 32 00:01:09,300 --> 00:01:12,090 at boot and better boot security. 33 33 00:01:12,090 --> 00:01:13,710 To be able to run a lot of the other things 34 34 00:01:13,710 --> 00:01:15,150 we're going to talk about in this lesson 35 35 00:01:15,150 --> 00:01:19,080 you have to have UEFI and not BIOS for your system. 36 36 00:01:19,080 --> 00:01:21,510 The good news is most systems nowadays, 37 37 00:01:21,510 --> 00:01:23,010 in fact I think almost all of them, 38 38 00:01:23,010 --> 00:01:25,500 will use UEFI and not BIOS. 39 39 00:01:25,500 --> 00:01:26,880 If you're using BIOS on a system, 40 40 00:01:26,880 --> 00:01:30,510 it's most likely a legacy device that is several years old. 41 41 00:01:30,510 --> 00:01:32,640 Now, the first thing we want to talk about inside of UEFI 42 42 00:01:32,640 --> 00:01:34,920 is this idea of a Secure Boot. 43 43 00:01:34,920 --> 00:01:37,920 This is a feature of UEFI that prevents unwanted processes 44 44 00:01:37,920 --> 00:01:40,380 from executing during the boot operation. 45 45 00:01:40,380 --> 00:01:42,750 Essentially, as a computer is booting up 46 46 00:01:42,750 --> 00:01:43,800 it's going to check things 47 47 00:01:43,800 --> 00:01:46,140 and make sure that there's digital signatures installed 48 48 00:01:46,140 --> 00:01:48,360 from those operating system vendors. 49 49 00:01:48,360 --> 00:01:50,850 If Microsoft Windows isn't signed by Microsoft, 50 50 00:01:50,850 --> 00:01:51,870 we're not going to boot it. 51 51 00:01:51,870 --> 00:01:53,670 That's the idea of Secure Boot. 52 52 00:01:53,670 --> 00:01:55,290 We want to make sure that the boot loader 53 53 00:01:55,290 --> 00:01:57,120 is only loading things that are valid 54 54 00:01:57,120 --> 00:01:58,620 and not loading malware. 55 55 00:01:58,620 --> 00:02:01,290 The next thing we have is what's known as a Measured Boot. 56 56 00:02:01,290 --> 00:02:03,450 Now, a Measured Boot is a UEFI feature 57 57 00:02:03,450 --> 00:02:06,360 that gathers secure metrics to validate the boot process 58 58 00:02:06,360 --> 00:02:08,250 in an attestation report. 59 59 00:02:08,250 --> 00:02:09,600 So as you're booting up, 60 60 00:02:09,600 --> 00:02:11,070 it's going to be taking different measurements. 61 61 00:02:11,070 --> 00:02:13,050 How much time does it take for you to do this? 62 62 00:02:13,050 --> 00:02:15,000 How much process does it take to do that? 63 63 00:02:15,000 --> 00:02:17,280 And based on that, it's going to collect that data, 64 64 00:02:17,280 --> 00:02:18,510 It's going to create a report, 65 65 00:02:18,510 --> 00:02:20,100 and then it's going to attest to it. 66 66 00:02:20,100 --> 00:02:22,590 Which brings us to the idea of attestation. 67 67 00:02:22,590 --> 00:02:24,150 Now, attestation is a claim 68 68 00:02:24,150 --> 00:02:26,520 that the data presented in a report is valid, 69 69 00:02:26,520 --> 00:02:28,650 and it does this by digitally signing it 70 70 00:02:28,650 --> 00:02:30,780 using the TPM's private key. 71 71 00:02:30,780 --> 00:02:33,450 So the UEFI is going to take that report, 72 72 00:02:33,450 --> 00:02:35,070 it's going to sign it with that digital key, 73 73 00:02:35,070 --> 00:02:37,230 and then send it on to the operating system 74 74 00:02:37,230 --> 00:02:38,430 and to the processor. 75 75 00:02:38,430 --> 00:02:40,740 This way, we know we can trust it. 76 76 00:02:40,740 --> 00:02:42,150 Now, the next thing we need to talk about 77 77 00:02:42,150 --> 00:02:43,680 as far as Trusted Firmware goes 78 78 00:02:43,680 --> 00:02:45,780 is the concept of eFUSE. 79 79 00:02:45,780 --> 00:02:48,180 Now, eFUSE is a means for software or firmware 80 80 00:02:48,180 --> 00:02:49,500 to permanently alter the state 81 81 00:02:49,500 --> 00:02:51,930 of a transistor on a computer chip. 82 82 00:02:51,930 --> 00:02:54,240 Now, this comes from the idea of a fuse. 83 83 00:02:54,240 --> 00:02:56,160 If you've ever worked with electricity before 84 84 00:02:56,160 --> 00:02:57,690 and you've worked in a breaker panel 85 85 00:02:57,690 --> 00:02:59,010 you may have seen things like these. 86 86 00:02:59,010 --> 00:03:00,210 These are fuses. 87 87 00:03:00,210 --> 00:03:02,910 Notice on the left, we have four fuses that are good, 88 88 00:03:02,910 --> 00:03:04,680 they have a straight line going through them. 89 89 00:03:04,680 --> 00:03:07,260 But the fifth one is actually a blown fuse. 90 90 00:03:07,260 --> 00:03:09,030 This means there is too much power that went through 91 91 00:03:09,030 --> 00:03:11,070 and that wire actually got broken. 92 92 00:03:11,070 --> 00:03:13,230 You can see it physically there that the wire is broken 93 93 00:03:13,230 --> 00:03:15,540 and there's kind of that burntness to it. 94 94 00:03:15,540 --> 00:03:17,460 You can't go back and replace this fuse 95 95 00:03:17,460 --> 00:03:19,350 back to looking like the ones on the left. 96 96 00:03:19,350 --> 00:03:21,780 It's going to be permanently and altered forever. 97 97 00:03:21,780 --> 00:03:23,970 That's the same idea here with an eFUSE. 98 98 00:03:23,970 --> 00:03:26,130 An eFUSE is an electronic fuse. 99 99 00:03:26,130 --> 00:03:28,230 It essentially uses one time programming 100 100 00:03:28,230 --> 00:03:30,270 that's used to seal these cryptographic keys 101 101 00:03:30,270 --> 00:03:31,500 and other security information 102 102 00:03:31,500 --> 00:03:33,450 during the firmware development process. 103 103 00:03:33,450 --> 00:03:35,100 If somebody tries to mess with that 104 104 00:03:35,100 --> 00:03:37,020 it will actually blow that fuse, 105 105 00:03:37,020 --> 00:03:39,030 making that product, that firmware, 106 106 00:03:39,030 --> 00:03:41,040 no longer valid or trusted. 107 107 00:03:41,040 --> 00:03:42,240 The next thing we want to talk about 108 108 00:03:42,240 --> 00:03:43,830 is Trusted Firmware updates, 109 109 00:03:43,830 --> 00:03:46,440 because we have to update our firmware over time. 110 110 00:03:46,440 --> 00:03:48,240 So when we have a Trusted Firmware update, 111 111 00:03:48,240 --> 00:03:50,310 this is a firmware update that is digitally signed 112 112 00:03:50,310 --> 00:03:52,530 by the vendor and trusted by the system 113 113 00:03:52,530 --> 00:03:53,880 before it's installed. 114 114 00:03:53,880 --> 00:03:56,430 Anytime you're going to go and do a firmware update 115 115 00:03:56,430 --> 00:03:58,050 you need to make sure that it is trusted, 116 116 00:03:58,050 --> 00:04:00,300 because if it's trying to do something that's not trusted 117 117 00:04:00,300 --> 00:04:02,460 you have the potential to blow one of these eFUSES 118 118 00:04:02,460 --> 00:04:04,050 that we just talked about. 119 119 00:04:04,050 --> 00:04:06,090 And the final concept with Trusted Firmware 120 120 00:04:06,090 --> 00:04:08,130 is a self-encrypting drive. 121 121 00:04:08,130 --> 00:04:10,440 Now, we've talked about self-encrypting drives before. 122 122 00:04:10,440 --> 00:04:11,940 These are disk drives where the controller 123 123 00:04:11,940 --> 00:04:14,730 can automatically encrypt the data that is written to it. 124 124 00:04:14,730 --> 00:04:17,010 Now, why are we talking about self-encrypting drives 125 125 00:04:17,010 --> 00:04:18,990 when we're talking about Trusted Firmware? 126 126 00:04:18,990 --> 00:04:21,150 Well, because these drives have firmware 127 127 00:04:21,150 --> 00:04:23,130 to run that encryption process. 128 128 00:04:23,130 --> 00:04:25,950 That is software on a chip and that is what firmware is. 129 129 00:04:25,950 --> 00:04:28,020 And so we need to make sure that the firmware 130 130 00:04:28,020 --> 00:04:30,240 on these self encrypting-drives is trusted 131 131 00:04:30,240 --> 00:04:32,190 and it follows a lot of these same basic principles 132 132 00:04:32,190 --> 00:04:33,870 that we've talked about through this lesson. 133 133 00:04:33,870 --> 00:04:35,520 The idea with these self-encrypting drives 134 134 00:04:35,520 --> 00:04:36,990 is that they have firmware on them 135 135 00:04:36,990 --> 00:04:38,550 that is used to do the encryption 136 136 00:04:38,550 --> 00:04:40,200 when data is being written to the drive. 137 137 00:04:40,200 --> 00:04:41,760 It also decrypts that information 138 138 00:04:41,760 --> 00:04:43,710 when data is being read from the drive. 139 139 00:04:43,710 --> 00:04:45,600 All of this is done at the hardware level, 140 140 00:04:45,600 --> 00:04:48,510 so it takes the processing load off of your own computer 141 141 00:04:48,510 --> 00:04:50,100 and off of your operating system, 142 142 00:04:50,100 --> 00:04:52,200 'cause it's all done here in the firmware.