Tuesday, November 15, 2011

Secure Boot - its here and been here for quite awhile ...

There's been a lot of noise with Microsoft requiring Secure Boot for Windows 8 OEMs. For those of you unfamiliar with it, Secure Boot requires that the boot chain is signed, and this 'feature' must be enabled by default. Although I have been unable to find specific details, it appears that the chain of trust needs to extend from BIOS/UEFI all the way down to the kernel. Obviously, requiring a signed boot chain makes using FOSS platforms like Ubuntu or Debian an impossibility short of having the UEFI Platform Key and resigning the entire chain.

Steven Sinofsky's MSDN blog has a fairly good overview how it works. Canonical and Red Hat also have a good white paper on why secure boot is a serious problem for Linux distributions. Even if secure boot itself can be disabled, it *greatly* rises the bar for general end-users to successfully install Ubuntu on their machine. In addition, it is the responsibility of OEM and BIOS manufacturers to provide the option to disable it.

There already has been a long history of OEMs removing BIOS options or introducing DRM; for instance, locking out VTx on Sony laptops, or restricting laptops to only accept 'branded' wifi and 3G cards. Given this track record, can OEMs realistically be trusted to have this option available?

What most people don't realize is that secure boot itself is not a new concept; its simply part of the Trusted Computing initiative, and has been implemented on embedded platforms for many years. If you own any iPhone, or one of the vast majority of Android devices, you are using a device that either has the secure boot feature, or something very close. This especially painful in Android as Google's security system restricts users to a *very* limited shell and subset of utilities which can be used on non-rooted devices. WebOS, Maemo, and to my knowledge Meego give the end-user full unrestricted access to the boot chain and you can swap kernels and even the entire OS out if one was so motivated.

Although it is still an ongoing problem, several vendors such as HTC, Samsung, Motorola (kinda), and even Sony. In the Android community, having unlockable bootloaders has been a welcome middle ground in the traditionally restrictive and locked-down world of cellular devices.

While some may argue that such locks are necessary to protect consumers, it is perfectly feasible to create devices with unlocked bootloaders that are still secure. The Nook Color's is an Android powered eReader. It's stock firmware doesn't allow sideloaded applications or even access to a user shell via adb, but the BootROM on the device attempts to boot from the microSD card before eMMC, making it possible for enterprising users to easily modify the underlying OS (as well as making it physically impossible to brick the device due to a bad flash). Barnes and Nobles even sells a book on rooting the Nook Color; it was right next to the devices on display at the time. In addition, they've continued the tradition of easily modifiable devices with both the Nook Simple Touch, and the Nook Tablet.

One of the most impressive attributes is the possibility of running Ubuntu on it. The absolute poster child for this is the Toshiba AC100. For those of you unfamiliar, it ultralight netbook that shipped with Android 2.1/2.2 with easy access to the built in flash via the mini-USB port on the side of the device. Due to the valiant efforts of the AC100 community, Ubuntu was ported to this device, and became a supported platform with images available on cdimages.ubuntu.com. If you were an attendee at UDS, you likely saw several AC100s all running Ubuntu.

This brings me to the point that motivated me to write this post in the first place. One of the most impressive tablets I've seen to date is the ASUS eeePad Transformer, an Android tablet with fully dockable keyboard. I have one of these devices, and its one of the most impressive and usable Android tablets I own. Sadly, such a powerful device was hobbled from its true potential due to ASUS's decision to ship the device with a locked and encrypted bootloader. Surprisingly, the Secure Boot Key (SBK) was acquired and released to the wild, making it possible to reflash the device. Sadly, even with the SBK, the device's bootloader is still extremely hobbled compared to the AC100 making flashing a slow and difficult process.

In response, ASUS refreshed the eeePad's hardware to the new B70 SKU, which has a new Secure Boot. Despite this, a root exploit was recently found to allow people to circumvent these restrictions and install customs ROMs. It is however only a manor of time before ASUS responds and releases a new update that fixes this bug.

Steven Barker (lilstevie) on xda-developers successfully created a port of Ubuntu to the Transformer. Currently, installing Ubuntu on the Transformer requires nvflash access, so its not possible to use his image on the newly liberated B70 devices. I am certain that a new method of installing via an update.zip will be developed for those of us with hobbled devices.

It is a showcase of what is possible when you have open hardware, and also proves one indisputable point: any 'trusted boot' or DRM scheme can and will be defeated; at best you piss off your userbase, and at worst, you force users to exploit bugs to gain control of their device. As it is impossible to reflash these devices from the bootloader, a failed kernel flash WILL brick these devices, increasing warranty and support costs as users try to return their now broken devices.

In closing, while there have been some victories in ongoing war of open hardware vs. trusted comptuing, the road ahead still remains very murky. Victories in the mobile market have shown that there is a market for open devices. Google's own Nexus One was sold as a developers phone and as a way to encourage manufacturers to raise the bar. It sold well enough to recoup its development costs.. While there is no official statements, the Nokia N900 is suspected to have broken all sales expectations, backed up by the fact that Angry Birds sold extremely well on the Ovi Store for the N900.

From the article in question:
What reaction have you had in terms of sales and customer feedback?

Angry Birds had already been launched on App Store before it came out on Ovi Store, and it had a great review average from iPhone reviewers and users alike, so we expected a good reception from N900 users as well.

Even so, we were quite surprised by just how the N900 community immediately took the game to heart. The game obviously made many people very happy, and that is really the greatest achievement that anyone who creates entertainment for a living can hope for. Well, maybe the greatest achievement is huge bundles of cash, but making people happy comes a close second.

In the first week that Angry Birds has been on the Ovi Store, it has been downloaded almost as many times as the iPhone version in six weeks. Given that most N900 users have not even used Ovi Store yet, we are confident that there will be many more downloads in the months to come, and are sure that the N900 version will be very profitable.

That being said, with Microsoft pushing secure boot and trusted computing down everyone's throats with Windows 8, it is hard to say what the future might hold for those of us who want to own our devices.

20 comments:

Anonymous said...

Hi,
I'm currently having a conversation about this piece on reddit, but I notice you've 0 comments here on your actual blog and feel kinda bad about that. You might want to consider switching to wordpress and installing the backtype connect plugin so that comments from reddit, etc. will show up here too :)

Donald Trump said...

Maxatron Plus problems and this is why thorough research is necessary to be aware of cold hard male enhancement facts.

keven peterson said...

Bionatrol Pro Enhance incredibly hard erections. Capatrex natural male enhancement has no known side effects, and its principle ingredients have been documented and analyzed in clinical studies with extensive detail.

Jhon wick said...

Synergex 7 likely. The right formulation and the right amounts of ingredients contained in the product is crucial as they are the essential factors that creates the potency of the product, and could be also be crucial as they could bring negative effects to the user.

Donald Trump said...

Bluoxyn extensively available in the market and they are quite capable of handling this type of sexual disorders. Men can take their help and cure themselves easily as per their requirement.

Donald Trump said...

Ryzex Male Enhancement treatments that can effectively improve the size of the male sex organ, resulting a more satisfying sex life. Some of the all natural male enhancement treatments are natural

Jhon wick said...

Keto Gedeon then food could perhaps be a means of you feeling happy and comforted. There are other articles that I have written on this subject but suffice it to say that overeating is NOT cause by being hungry.

Donald Trump said...

Super Fast Keto Boost you lose the initial pounds you need to shed, and give you advice on how to keep them off, but the rest is up to you. Going straight back to your old habits is not going to help you stay in shape, or stay healthy.

Maxwell said...

Keto Trim 800
Before you choose a weight loss program, let's go through those tips one more time. This time, put them into practice - lose the weight, and keep it off.

Donald Trump said...

Ultragenik Keto burn its stored glycogen for energy fuel. Glycogen is essentially made up of 75% water and 25% glucose and therefore when glucose is metabolized, water is largely produced as a by-

Donald Trump said...

Celaxryn RX India, China, Malaysia, and Africa, that promote female and male sexual enhancement. Passion Rx provides a natural solution for those looking for an alternative to synthetic drugs.

Jhon wick said...

Evianne Cream . Imagine looking 10 or even 20 years younger. Have the age of 50 and look like you are in your upper 20s. A lot of people are like that. It is no secret what they are doing. They are using products

Donald Trump said...

Spartan Keto to lose. You could write a goal using your body measurements or percentage of body fast lost, or it may be your desirable clothing size. Set your goals in a way that they are attainable. For example, I want to lose 15 pounds by Christmas or I want to drop 2 dress sizes by my sister's wedding.

Donald Trump said...

Ultimate Keto Boost In order to be successful at weight loss you have to want to lose the weight. You must commit to this want, not just say that you want to lose the weight. The best way to commit to losing weight is to make a goal, write it down, then stick to it.

Donald Trump said...

Fusion Rise Keto felt great pleasure You soon relaxed and fell asleep.

Your subconscious mind was strongly imprinted by your very early experiences of eating...with pleasure and relaxation. Now, as an adult, every time you feel nervous, stressed, or upset, you

hassan said...

Customer Helpline Australia $1,100 for Self and $2,2 hundred for Self and circle of relatives insurance. The maximum amount out-of-pocket limits for HDHPs is $five,600 for self and $eleven,200 for Self and family enrollment. These deductible limits are referred to as IRS limits as they're set by way of the internal revenue provider (IRS). In HDHPs the relation between the deductibles and the top class paid with the aid of the insured is inversely propotional i.E. Better the deductible, lower the premium and vice versa. The essential purported benefits of HDHPs are that they will a) lower fitness care expenses with the aid of causing patients to be more cost-aware, and b) make
https://customerhelplineaustralia.com/

Health said...

Keto Meal Plan Because these terms are used interchangeably or as synonyms, i have wondered simply how exceptional or the identical those phrases are? After I framed out this question in my mind, I notion it'd be easy enough to just appearance-up their definitions and i would have my answer. However, boy changed into I incorrect. Definitions simplest were given me up to now and not very some distance at tha.

http://ketomealplan.reviews/

asasasasa said...

kingship? If in case you have, then you're a king, you might have EARNED it. The only difficulty is, you preserve forgetting that you're a king... You are a king with amnesia. It's adequate, if a king has a Cylophin RX mnesia, he's nonetheless a king correct? So you are a king with amnesia... But wait, there's extra... You additionally aroused from sleep in pauper's garb... Can you suppose on the implications of this? Which means that you begin to feel that you are a .

https://www.testosteroneboostclassi.com/cylophin-rx/

asasasasa said...

of the food regimen. Weight reduction standards: eat a better substantial kind of energy than you're making use of and you ma Rapid Keto Prime y additionally put on weight; utilize extra than you devour and you'll lose it. Weight reduction is presently an intention as a way to also be come to resultseasily correctly in the occasion that we adhere to a coaching management, abstain from meals set up. Be that as it is able to likely, for a few, surgery is in most instances the critical get hold of as .

https://www.healthmassive.com/rapid-keto-prime/

Aptron Noida said...

Android 6 Weeks Summer Training In Noida