microsoft discovers remote attestation

Via slashdot: Microsoft’s corporate VP for trustworthy computing – Scott Charney – has published a position paper that boils down to remote attestation: let ISPs cut off internet access for computers that are not deemed free of malware.

So… how would this work? Presumably the computer would run some code that is not under the control of the user/owner of the machine, and protected by the TPM module. That code would then validate if the machine is free of malware or not – somehow. I have no idea how that could possibly be foolproof, but let’s assume for a moment there is a way to do this.

First problem: your computer would have to run code that most likely comes without source, is hard or impossible to inspect, and cannot be changed.

Let’s say for the sake of argument that this validation code is somehow optional. Or perhaps you are an enterprising person, and you’ve managed to kick this stuff off your computer (TPM-ectomy, anyone?). Next problem: now you can’t validate your computer with your ISP to prove that it is free of malware. To do that, you need access to the secret encryption key buried in the TPM.

This is called remote attestation: the machine(s) your computer communicates with can see information about your computer – say, what operating system you run, and what patch level – and because that data is signed or encrypted by your TPM chip, you can not change it.

Note that it’s already pretty easy for remote machines to see what (version of) an operating system a computer runs, for instance with TCP/IP fingerprinting, but that is easy to fake.

Remote attestation is the real danger of ‘trustworthy’ computing. They can try to put all sorts of things in the hardware; if people have physical access, someone will find a way around it. But if they make it impossible to network your computer without an operational TPM chip then we might as well kiss all our free software and free hardware goodbye. It won’t be any good to run a computer with GNU/Linux, if we can’t go online with it… Or if our online banking refuses to talk to our computer because our machine is not deemed to be running a fully patched version of Windows.

Given that this position paper comes from Microsoft, it’s not too hard to see where they want to go. Microsoft would love to be in a position where ISPs and banks require certain patchlevels of its software. Can you imagine a better way to force people to keep upgrading their Windows licenses? Or to force people to stop using free operating systems?

I have a better idea to combat the malware problem, mr. Charney. Why don’t we ask people to stop using Windows. Without Windows, the malware/botnet problem would not be nearly as bad as it is today.