February 10, 2010 7:06AM  |
Christopher Tarnovsky’s discovery shows a way that spies can acquire military and trade secrets. Tarnovsky figured out a way to break chips that carry a “Trusted Platform Module,” or TPM, designation by essentially spying on them like a phone conversation. “You’ve trusted this chip . . . but your secrets aren’t that safe,” said Tarnovsky.
 Deep inside millions of computers is a digital Fort Knox, a special chip with the locks to highly guarded secrets, including classified government reports and confidential business plans. Now a former U.S. Army computer-security specialist has devised a way to break those locks.The attack can force heavily secured computers to spill documents that likely were presumed to be safe. This discovery shows one way that spies and other richly financed attackers can acquire military and trade secrets, and comes as worries about state-sponsored computer espionage intensify, underscored by recent hacking attacks on Google Inc. The new attack discovered by Christopher Tarnovsky is difficult to pull off, partly because it requires physical access to a computer. But laptops and smart phones get lost and stolen all the time. And the data that the most dangerous computer criminals would seek likely would be worth the expense of an elaborate espionage operation. Jeff Moss, founder of the Black Hat security conference and a member of the U.S. Department of Homeland Security’s advisory council, called Tarnovsky’s finding “amazing.” “It’s sort of doing the impossible,” Moss said. “This is a lock on Pandora’s box. And now that he’s pried open the lock, it’s like, ooh, where does it lead you?” Tarnovsky figured out a way to break chips that carry a “Trusted Platform Module,” or TPM, designation by essentially spying on them like a phone conversation. Such chips are billed as the industry’s most secure and are estimated to be in as many as 100 million personal computers and servers, according to market research firm IDC. When activated, the chips provide an additional layer of security by encrypting, or scrambling, data to prevent outsiders from viewing information on the machines. An extra password or identification such as a fingerprint is needed when the machine is turned on. Many computers sold to businesses and consumers have such chips, though users might not turn them on. Users are typically given the choice to turn on a TPM chip when they first use a computer with it. If they ignore the offer, it’s easy to forget the feature exists. However, computers needing the most security typically have TPM chips activated. “You’ve trusted this chip to hold your secrets, but your secrets aren’t that safe,” said Tarnovsky, 38, who runs the Flylogic security consultancy in Vista, California, and demonstrated his hack last week at the Black Hat security conference in Arlington, Virginia. (continued…)
© 2010 Associated Press under contract with YellowBrix. All rights reserved. |
