Comments by "Edward Cullen" (@edwardcullen1739) on "Louis Rossmann"
channel.
-
90
-
41
-
28
-
24
-
16
-
15
-
14
-
11
-
10
-
10
-
8
-
7
-
7
-
6
-
6
-
6
-
6
-
5
-
4
-
4
-
4
-
4
-
3
-
3
-
3
-
3
-
3
-
3
-
3
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
@jerrylove865 Notwithstanding the obvious straw-man argument, you demonstrate a lack of knowledge and understanding of how computer hardware works, the attacks that this technology is intended to defeat and how it is actually implemented.
And actually, verifying the keyboard IS important, as there have been recorded instances of people injecting key loggers into the keyboard at a hardware level.
But, dafuk do I know? 🤷♂️
If you think this doesn't pass the "smell" test, it's because you have zero clue what "good" and "bad" are supposed to smell like.
Asking for a circuit diagram is just a loser move. It's a pathetic attempt to "win" an "argument" by demanding something you know cannot be produced.
Oh, and this isn't an argument. This is someone who actually knows what they're talking about correcting your misconceptions. Deal with it.
I'll repeat: the objective here is to defeat supply chain and firmware-level malware injection attacks by making the operator aware that an attack has taken place and to also make those attacks more difficult.
To defeat this implementation, one would need to replace the CPU, which can be detected by manually confirming the CPU serial number (which is hard coded into the CPU).
If the the verification hardware is on the board, then it could be defeated by modifying the board, as, ultimately, it would be setting a pin out to high or low. Unless, of course, the CPU does a cryptographic verification of some hardware component... Which would require that the key be included in the CPU... Which is precisely the implementation they have 🤦♂️
This implementation, because it verifies the loaded BIOS image cannot be defeated (or would require obscene investment to defeat), because the CPU is doing the verification. Replacing the CPU can be detected by verify the serial number, which is hard-coded into the CPU itself. You would, therefore, need to either modify the CPU or somehow get a new CPU and spoof the serial number. Or, somehow, convince the CPU to load one BIOS image but verify another...
Plus, you probably should verify your HDMI cables, because there's no reason it can't contain a transmitter that is mirroring the output... But of course, you knew that already, didn't you?
And the reason for memory encryption is to ensure that the contents of memory cannot be modified by anything other than the CPU. A modified board could, theoretically, arbitrarily modify memory contents (say, by overwriting the fixed location at which the BIOS is loaded into memory, AFTER the CPU has done verification...)
The bottom line here is that teams of people, who, individually are smarter, better educated and more experienced in defeating hardware-level attacks, than you or I, have put a LOT of time and effort into this design. They neither put in superfluous features, nor left out features that need to be there.
1