1 00:00:00,320 --> 00:00:02,010 Trusted firmware. 2 00:00:02,010 --> 00:00:04,450 In this lesson, we're going to talk about a handful 3 00:00:04,450 --> 00:00:05,860 of different types of things 4 00:00:05,860 --> 00:00:08,350 that we use within trusted firmware. 5 00:00:08,350 --> 00:00:11,120 This is going to include seven different items. 6 00:00:11,120 --> 00:00:12,910 Now, as I talk about trusted firmware, 7 00:00:12,910 --> 00:00:15,180 we have to think about the idea of a firmware exploit 8 00:00:15,180 --> 00:00:17,140 because we're trying to prevent firmware exploits 9 00:00:17,140 --> 00:00:18,700 by using trusted firmware. 10 00:00:18,700 --> 00:00:20,560 A firmware exploit is going to give an attacker 11 00:00:20,560 --> 00:00:22,260 an opportunity to run any code 12 00:00:22,260 --> 00:00:24,800 at the highest level of CPU privilege. 13 00:00:24,800 --> 00:00:26,160 Because if you're at the firmware, 14 00:00:26,160 --> 00:00:28,270 for instance, in the BIOS or the UEFI, 15 00:00:28,270 --> 00:00:30,320 you can actually have essentially a rootkit 16 00:00:30,320 --> 00:00:32,020 that runs over the entire system 17 00:00:32,020 --> 00:00:34,350 and that's loaded even before Windows is. 18 00:00:34,350 --> 00:00:37,210 So, your anti-malware is not going to find it. 19 00:00:37,210 --> 00:00:39,620 Now, when we talk about these different trusted firmware, 20 00:00:39,620 --> 00:00:41,520 there's lots of different terms we have to cover. 21 00:00:41,520 --> 00:00:43,100 This includes things like UEFI, 22 00:00:43,100 --> 00:00:45,490 the unified extensible firmware interface, 23 00:00:45,490 --> 00:00:49,250 secure boot, measured boot, attestation, eFuse, 24 00:00:50,110 --> 00:00:53,270 trusted firmware updates, and self-encrypting drives. 25 00:00:53,270 --> 00:00:54,520 As we go through this lesson, 26 00:00:54,520 --> 00:00:56,620 we're going to talk about each of these seven. 27 00:00:56,620 --> 00:00:57,480 The first one is 28 00:00:57,480 --> 00:01:01,160 Unified Extensible Firmware Interface or UEFI. 29 00:01:01,160 --> 00:01:03,560 This is a type of system firmware providing support 30 00:01:03,560 --> 00:01:06,880 for 64-bit CPU operations at boot. 31 00:01:06,880 --> 00:01:10,060 It also gives you a full GUI and mouse operations at boot 32 00:01:10,060 --> 00:01:12,050 and better boot security. 33 00:01:12,050 --> 00:01:14,280 To be able to run a lot of the other things we're going to talk 34 00:01:14,280 --> 00:01:15,140 about in this lesson, 35 00:01:15,140 --> 00:01:19,060 you have to have UEFI and not BIOS for your system. 36 00:01:19,060 --> 00:01:21,510 The good news is most systems nowadays, 37 00:01:21,510 --> 00:01:24,140 in fact, I think almost all of them will use UEFI 38 00:01:24,140 --> 00:01:25,490 and not BIOS. 39 00:01:25,490 --> 00:01:26,870 If you're using BIOS on a system, 40 00:01:26,870 --> 00:01:30,500 it's most likely a legacy device that is several years old. 41 00:01:30,500 --> 00:01:32,630 Now, the first thing we want to talk about inside of UEFI 42 00:01:32,630 --> 00:01:34,880 is this idea of a secure boot. 43 00:01:34,880 --> 00:01:37,910 This is a feature of UEFI that prevents unwanted processes 44 00:01:37,910 --> 00:01:40,360 from executing during the boot operation. 45 00:01:40,360 --> 00:01:42,750 Essentially, as a computer is booting up, 46 00:01:42,750 --> 00:01:44,530 it's going to check things and make sure 47 00:01:44,530 --> 00:01:46,110 that there's digital signatures installed 48 00:01:46,110 --> 00:01:48,340 from those operating system vendors. 49 00:01:48,340 --> 00:01:50,840 If Microsoft Windows isn't signed by Microsoft, 50 00:01:50,840 --> 00:01:51,850 we're not going to boot it. 51 00:01:51,850 --> 00:01:53,670 That's the idea of secure boot. 52 00:01:53,670 --> 00:01:55,260 We want to make sure that the bootloader 53 00:01:55,260 --> 00:01:57,120 is only loading things that are valid 54 00:01:57,120 --> 00:01:58,600 and not loading malware. 55 00:01:58,600 --> 00:02:01,270 The next thing we have is what's known as measured boot. 56 00:02:01,270 --> 00:02:03,460 Now, a measure boot is a UEFI feature 57 00:02:03,460 --> 00:02:06,550 that gathers secure metrics to validate the boot process in 58 00:02:06,550 --> 00:02:08,220 an attestation report. 59 00:02:08,220 --> 00:02:09,560 So, as you're booting up, 60 00:02:09,560 --> 00:02:11,080 it's going to be taking different measurements, 61 00:02:11,080 --> 00:02:13,040 how much time does it take for you to do this? 62 00:02:13,040 --> 00:02:14,870 How much process should it take to do that, 63 00:02:14,870 --> 00:02:17,260 and based on that, it's going to collect that data, 64 00:02:17,260 --> 00:02:18,490 it's going to create a report, 65 00:02:18,490 --> 00:02:20,100 and then it's going to attest to it. 66 00:02:20,100 --> 00:02:22,560 Which brings us to the idea of attestation. 67 00:02:22,560 --> 00:02:24,130 Now, an attestation is a claim 68 00:02:24,130 --> 00:02:26,530 that the data presented in a report is valid, 69 00:02:26,530 --> 00:02:28,640 and it does this by digitally signing it 70 00:02:28,640 --> 00:02:30,730 using the TPM's private key. 71 00:02:30,730 --> 00:02:33,430 So, the UEFI, it's going to take that report, 72 00:02:33,430 --> 00:02:35,040 it's going to sign it with that digital key, 73 00:02:35,040 --> 00:02:37,230 and then send it on to the operating system 74 00:02:37,230 --> 00:02:38,420 into the processor. 75 00:02:38,420 --> 00:02:40,710 This way we know we can trust it. 76 00:02:40,710 --> 00:02:42,420 Now, the next thing we need to talk about as far 77 00:02:42,420 --> 00:02:45,013 as trusted firmware goes is the concept of eFuse. 78 00:02:45,926 --> 00:02:47,650 Now, eFuse is a means for software 79 00:02:47,650 --> 00:02:49,470 or firmware to permanently alter the state 80 00:02:49,470 --> 00:02:51,920 of a transistor on a computer chip. 81 00:02:51,920 --> 00:02:54,220 Now, this comes from the idea of a fuse. 82 00:02:54,220 --> 00:02:56,130 If you've ever worked with electricity before, 83 00:02:56,130 --> 00:02:57,680 and you've worked in a breaker panel, 84 00:02:57,680 --> 00:02:59,010 you may have seen things like these, 85 00:02:59,010 --> 00:03:00,200 these are fuses. 86 00:03:00,200 --> 00:03:02,890 Notice on the left, we have four fuses that are good, 87 00:03:02,890 --> 00:03:04,660 they have a straight line going through them. 88 00:03:04,660 --> 00:03:07,250 But the fifth one is actually a blown fuse. 89 00:03:07,250 --> 00:03:09,030 This means there is too much power that went through 90 00:03:09,030 --> 00:03:11,050 and that wire actually got broken. 91 00:03:11,050 --> 00:03:12,260 You can see it physically there 92 00:03:12,260 --> 00:03:13,450 that the wire is broken 93 00:03:13,450 --> 00:03:15,520 and there's kind of that brightness to it. 94 00:03:15,520 --> 00:03:17,720 You can't go back and replace this fuse back 95 00:03:17,720 --> 00:03:19,350 to looking like the ones on the left, 96 00:03:19,350 --> 00:03:21,770 it's going to be permanently altered forever. 97 00:03:21,770 --> 00:03:24,000 That's the same idea here with an eFuse. 98 00:03:24,000 --> 00:03:26,110 An eFuse is an electronic fuse. 99 00:03:26,110 --> 00:03:28,210 It essentially uses one-time programming 100 00:03:28,210 --> 00:03:30,270 that's used to seal these cryptographic keys 101 00:03:30,270 --> 00:03:31,500 and other security information 102 00:03:31,500 --> 00:03:33,420 during the former development process. 103 00:03:33,420 --> 00:03:35,090 If somebody tries to mess with that, 104 00:03:35,090 --> 00:03:37,030 it will actually blow that fuse, 105 00:03:37,030 --> 00:03:38,100 making that product, 106 00:03:38,100 --> 00:03:41,040 that firmware, no longer valid or trusted. 107 00:03:41,040 --> 00:03:42,230 The next thing we want to talk about 108 00:03:42,230 --> 00:03:43,820 is trusted firmware updates, 109 00:03:43,820 --> 00:03:46,410 because we have to update our firmware over time. 110 00:03:46,410 --> 00:03:48,230 So, when we have a trusted firmware update, 111 00:03:48,230 --> 00:03:49,320 this is a firmware update 112 00:03:49,320 --> 00:03:51,090 that is digitally signed by the vendor 113 00:03:51,090 --> 00:03:53,860 and trusted by the system before it's installed. 114 00:03:53,860 --> 00:03:56,430 Anytime you're going to go and do a firmware update, 115 00:03:56,430 --> 00:03:58,010 you need to make sure that it is trusted 116 00:03:58,010 --> 00:04:00,270 because if it's trying to do something that's not trusted, 117 00:04:00,270 --> 00:04:02,440 you have the potential to blow one of these eFuses 118 00:04:02,440 --> 00:04:03,900 that we just talked about. 119 00:04:03,900 --> 00:04:06,060 And the final concept with trusted firmware 120 00:04:06,060 --> 00:04:08,120 is a self-encrypting drive. 121 00:04:08,120 --> 00:04:10,430 Now, we've talked about self-encrypting drives before, 122 00:04:10,430 --> 00:04:11,910 these are disk drives where the controller 123 00:04:11,910 --> 00:04:14,730 can automatically encrypt the data that is written to it. 124 00:04:14,730 --> 00:04:17,060 Now, why are we talking about self-encrypting drives 125 00:04:17,060 --> 00:04:18,950 when we're talking about trusted firmware? 126 00:04:18,950 --> 00:04:21,580 Well, because these drives have firmware to run 127 00:04:21,580 --> 00:04:23,110 that encryption process, 128 00:04:23,110 --> 00:04:24,500 that is, software on a chip 129 00:04:24,500 --> 00:04:25,860 and that is what firmware is. 130 00:04:25,860 --> 00:04:27,140 And so we need to make sure 131 00:04:27,140 --> 00:04:30,250 that this firmware on the self-encrypting drives is trusted, 132 00:04:30,250 --> 00:04:32,220 and it follows a lot of these same basic principles 133 00:04:32,220 --> 00:04:33,860 that we've talked about through this lesson. 134 00:04:33,860 --> 00:04:35,670 The idea with these self-encrypting drives is 135 00:04:35,670 --> 00:04:36,990 that they have firmware on them 136 00:04:36,990 --> 00:04:38,550 that is used to do the encryption 137 00:04:38,550 --> 00:04:40,220 when data is being written to the drive. 138 00:04:40,220 --> 00:04:41,740 It also decrypts that information 139 00:04:41,740 --> 00:04:43,680 when data is being read from the drive. 140 00:04:43,680 --> 00:04:45,570 All of this is done at the hardware level, 141 00:04:45,570 --> 00:04:48,490 so it takes the processing load off of your own computer 142 00:04:48,490 --> 00:04:50,030 and off of your operating system, 143 00:04:50,030 --> 00:04:52,180 because it's all done here in the firmware.