-: Trusted firmware.
In this lesson, we're going to talk about a handful
of different types of things
that we use within trusted firmware.
This is going to include seven different items.
Now, as I talk about trusted firmware,
we have to think about the idea of a firmware exploit
because we're trying to prevent firmware exploits
by using trusted firmware.
A firmware exploit is going to give an attacker
an opportunity to run any code
at the highest level of CPU privilege.
Because if you're at the firmware,
for instance, in the BIOS or the UEFI,
you can actually have essentially a rootkit
that runs over the entire system
and that's loaded even before Windows is.
So, your anti-malware is not going to find it.
Now, when we talk about these different trusted firmware,
there's lots of different terms we have to cover.
This includes things like UEFI,
the unified extensible firmware interface,
secure boot, measured boot, attestation, eFuse,
trusted firmware updates, and self-encrypting drives.
As we go through this lesson,
we're going to talk about each of these seven.
The first one is
Unified Extensible Firmware Interface or UEFI.
This is a type of system firmware providing support
for 64-bit CPU operations at boot.
It also gives you a full GUI and mouse operations at boot
and better boot security.
To be able to run a lot of the other things we're going to talk
about in this lesson,
you have to have UEFI and not BIOS for your system.
The good news is most systems nowadays,
in fact, I think almost all of them will use UEFI
and not BIOS.
If you're using BIOS on a system,
it's most likely a legacy device that is several years old.
Now, the first thing we want to talk about inside of UEFI
is this idea of a secure boot.
This is a feature of UEFI that prevents unwanted processes
from executing during the boot operation.
Essentially, as a computer is booting up,
it's going to check things and make sure
that there's digital signatures installed
from those operating system vendors.
If Microsoft Windows isn't signed by Microsoft,
we're not going to boot it.
That's the idea of secure boot.
We want to make sure that the bootloader
is only loading things that are valid
and not loading malware.
The next thing we have is what's known as measured boot.
Now, a measure boot is a UEFI feature
that gathers secure metrics to validate the boot process in
an attestation report.
So, as you're booting up,
it's going to be taking different measurements,
how much time does it take for you to do this?
How much process should it take to do that,
and based on that, it's going to collect that data,
it's going to create a report,
and then it's going to attest to it.
Which brings us to the idea of attestation.
Now, an attestation is a claim
that the data presented in a report is valid,
and it does this by digitally signing it
using the TPM's private key.
So, the UEFI, it's going to take that report,
it's going to sign it with that digital key,
and then send it on to the operating system
into the processor.
This way we know we can trust it.
Now, the next thing we need to talk about as far
as trusted firmware goes is the concept of eFuse.
Now, eFuse is a means for software
or firmware to permanently alter the state
of a transistor on a computer chip.
Now, this comes from the idea of a fuse.
If you've ever worked with electricity before,
and you've worked in a breaker panel,
you may have seen things like these,
these are fuses.
Notice on the left, we have four fuses that are good,
they have a straight line going through them.
But the fifth one is actually a blown fuse.
This means there is too much power that went through
and that wire actually got broken.
You can see it physically there
that the wire is broken
and there's kind of that brightness to it.
You can't go back and replace this fuse back
to looking like the ones on the left,
it's going to be permanently altered forever.
That's the same idea here with an eFuse.
An eFuse is an electronic fuse.
It essentially uses one-time programming
that's used to seal these cryptographic keys
and other security information
during the former development process.
If somebody tries to mess with that,
it will actually blow that fuse,
making that product,
that firmware, no longer valid or trusted.
The next thing we want to talk about
is trusted firmware updates,
because we have to update our firmware over time.
So, when we have a trusted firmware update,
this is a firmware update
that is digitally signed by the vendor
and trusted by the system before it's installed.
Anytime you're going to go and do a firmware update,
you need to make sure that it is trusted
because if it's trying to do something that's not trusted,
you have the potential to blow one of these eFuses
that we just talked about.
And the final concept with trusted firmware
is a self-encrypting drive.
Now, we've talked about self-encrypting drives before,
these are disk drives where the controller
can automatically encrypt the data that is written to it.
Now, why are we talking about self-encrypting drives
when we're talking about trusted firmware?
Well, because these drives have firmware to run
that encryption process,
that is, software on a chip
and that is what firmware is.
And so we need to make sure
that this firmware on the self-encrypting drives is trusted,
and it follows a lot of these same basic principles
that we've talked about through this lesson.
The idea with these self-encrypting drives is
that they have firmware on them
that is used to do the encryption
when data is being written to the drive.
It also decrypts that information
when data is being read from the drive.
All of this is done at the hardware level,
so it takes the processing load off of your own computer
and off of your operating system,
because it's all done here in the firmware.