Don't let paranoia over the NSA and TPM weaken your security

Don't let paranoia over the NSA and TPM weaken your security

Summary: Conspiracy theorists are screaming that the NSA and Microsoft are in cahoots to insert a backdoor into all your hardware. The conspiracy is so vast, in fact, that they've even managed to snag Microsoft's most bitter rival.


The unintended by-product of Edward Snowden’s NSA document dump is a bull market in paranoid conspiracy theories.

The latest example is the breathless report out of Germany that Microsoft and the NSA have conspired to give American spies access to every copy of Windows 8, enforced by a mysterious chip called the Trusted Platform Module, or TPM. “It’s a backdoor!” scream the conspiracy theorists.

Apparently, Microsoft is so powerful that it is able to influence even its most bitter enemies. Consider this graphic, from a whitepaper commissioned by the Trusted Computing Group, which manages the TPM standard. It explains how the TPM chip uses cryptographic keys to verify that an operating system hasn’t been tampered with:


Image credit: SANS whitepaper, “Hardware Trust and TPM.”

Notice anything off about that graphic? Yeah, that’s a Chromebook logo. If you buy a Chromebook, powered by Google’s operating system without a hint of Windows 8 anywhere in it, it will be protected by a Verified Boot process, enforced by the same TPM chip used in Windows devices.

Here’s Google’s explanation:

The goal of Verified Boot is to provide cryptographic assurances that the system code hasn’t been modified by an attacker on the Chromebook. Additionally, we use lockable, non-volatile memory (NVRAM) in the TPM to ensure that outdated signatures won’t be accepted. To put this into perspective, the system does all this in about 8 seconds.

If you don't want to boot Google-verified software — let's say you built your own version of Chromium OS — no problem. You can flip the developer switch on your device and use the Chromebook however you'd like. It’s yours, after all!

You can do the same thing on a Windows device by disabling the Secure Boot option. That option is on by default, to prevent rootkits from being able to compromise a machine. But if you have physical access to the machine, you can go into its settings and disable that option, at which point you are free to do whatever you like.

The point is, a TPM is a platform-neutral device. It provides a secure way to encrypt data so that it can't be accessed by anyone except you, and it protects your device from being tampered with. Both of those features are highly desirable these days.

But who knows what’s going on in that chip? I mean, they say it's just a secure place to store encrypted keys, but who knows what else it can do? Obviously the American government or maybe the Chinese have intimidated the chip’s manufacturer, right?

Uh, maybe not. The most popular maker of TPM technology is Infineon Technologies AG, which is based in … Neubiberg, Germany. Perhaps those intrepid German journalists could, you know, hop on a train and head down to Infineon to see for themselves.


Look, we’re well into the 21st Century. Devices and operating systems are tightly integrated because they have to be, for common-sense reasons of reliability and security. Strong encryption, supported by dedicated hardware built according to standards hashed out in public by the technology industry, is a crucial part of protecting both the privacy of your personal data and the integrity of your device.

The irony is that conspiracy theorists who can convince you to avoid using the TPM because it’s somehow evil will actually make it easier for spies and criminals to access your secrets.

Well played, my paranoid friends. Well played.

Topics: Security, Google, Hardware, Microsoft

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Paranoia is when

    you aren't being spied upon. Well, we are. Now what?

    I was talking to a Dutch citizen yesterday, and he is old enough to remember the NAZI occupation. He's a Liberal, tried and true, and he's scared. He has good reason.
    Tony Burzio
    • The only security is in Open Source

      With an Open Source OS there are no secret back doors.

      People sticking to Windows when we have mature Open Source options like Linux are throwing their customers privacy to the NSA wolves. There is no need for that. We have Linux, we have Ubuntu, we have Mint, no one needs to let the NSA control their operating system.

      Microsoft cannot be trusted by their own official statements:
      • No, no it isn't

        Please explain exactly how using an Open Source OS will prevent anyone from intercepting your email and web traffic.

        Please explain how using an Open Source OS on a client increases security on a web site or service that is running on an Open Source OS and suffers an intrusion and data theft.

        Please explain how an Open Source OS will prevent a government (or corporation, or private individual) from modifying a network device running said Open Source OS and placing in the wild to capture data (see speculation on the NSA running Tor exit nodes)

        The reality is that the problem is people and policy, not the software used. The plus side to a free and open Internet is that people can do whatever they want on it. The negative side to a free and open internet is that people can do whatever they want on it.

        (As an aside, people who naively believe they ever had an expectation of privacy on phone calls are too young or too ignorant of history to remember operator dialed calls and party lines.)
        • Obvious did not RTFA

          This is about the OS having back doors to the NSA. How you protect the rest of your network is an entirely separate matter. Whatever it is you do, you cannot start with a system that is already compromised and expect privacy.
          • T1Oracle: "This is about the OS having back doors"


            From the article:

            "a mysterious chip called the Trusted Platform Module, or TPM"

            A "chip" is hardware and any firmware involved is separate from the OS.
            Rabid Howler Monkey
          • Re: "a mysterious chip called the Trusted Platform Module, or TPM"

            Let's forget, this is Ed Bott.

            There is nothing mysterious about TPM. It has been around for ages.

            It has nothing to do with Windows as such, too. Been used for some really neat tricks for good purposes on other OSes. It's only Windows that uses it for... not so good things for the user.
          • Actually drivers/firmware are part of the OS

            Look up the definition of Operation System.

            OS - The collection of software programs that interacts directly with hardware to provide systems and services to programs running on top of it.

            This is why drivers go directly into the Kernel in Linux.
          • Actually drivers are, firmware isn't.

            You see, firmware is programmable HARDWARE...
            Mike Galos
          • Fair enough

            But TPM won't work without a driver.
      • really?

        I run Linux too got 3 PCs strictly dual boot Ubuntu and Mint, and I can hack into one from another, get what I need from my desktop from a laptop in another room. I hack my son's from time to time Mint 13 to see what he looking at or watching (he's 9, a minor, and my son so it's legal)
        my point.... If me a super amature at hacking can get in, then the NSA, whom hires and aquires hackers to do their bidding, can easily get in! Every OS has a back door, you just need to find it. And a big Government Organization (who can arrest hackers and give them an option, jail or a job) will have the best. Let that run through your conspiracy theories!
        • "Hacking"

          Yeah, you have no clue what "hacking" is. Simply accessing one of your own machines over your own home network is NOT hacking. Using built-in functionality to interact with networked devices is just calling "using" them, not "hacking". Kindly learn the difference before making yourself sound like more of an idiot.

          "Every OS has a backdoor, you just have to find it". Another ignorant statement. I won't bother asking you to give an example of a backdoor in Linux or Unix because I fully expect your answer to be "they just haven't found them yet!!". Conspiracy theories, indeed.
      • Absolutely


        and copyright Law protects Microsoft's Sourcecode if they choose to allow public scrutiny so there is no valid reason to keep it closed

        Hardware disk encryption is backdoored by design and closed source encryption cannot be trusted

        Every Microsoft Operating System in the past 10 years is nothing more than a Government Sponsored Spyware Platform

        Whenever we show proof, they say you don't have any proof

        Whenever we want to debate them in public they call us tin foil hat wearing nuttjob conspiracy theorists and refuse to debate the issues

        Then they manufacture and promote totally absurd conspiracy theories to show the public how crazy we are

        Look what they are doing to Snowden right now, promoting alleged documents that Snowden never released yet is being attributed to him
    • Paranoia

      The Nazi's are long gone and they are not coming back and they did not need internet anyway. So what is the paranoia about?
    • Bullseye

      When it's really happening, it isn't paranoia. And there isn't any "conspiracy between Microsoft and the Government." The state will simply order Microsoft to comply, and Microsoft will. Because they have no choice. Because, despite everything you've been indoctrinated to believe for the last thirty years in our public education system, GOVERNMENTS have more power than businesses.
    • TPM = Thought Police Module

      This is not paranoia, TPM throughout it's turbulent history has had well founded allegations hurled in it's direction that it wide open to abuse from copyright cartels through to government spies.

      Ed, this in not a new debate about that miraculously appeared out of thin air when Snowden arrived on the scene, it has been rumbling on for years.

      The trouble with TPM is you will not own, see or be able to modify the keys to your own front door.
      Alan Smithie
    • Those who sacrifice freedom security...

      Here's an idea: How about we fingerprint every ten year old in the country JUST IN CASE they commit a crime when they become a teen? I don't see the difference in this and the NSA SCANDAL.
      Steven Lemon
      • You may have meant this comment as a sarcastic remark,

        unfortunately, something just as sinister is already being tested...RIF implants! These implants were first introduced as a way to track pets, now they have the notion to use them to track children in case they are abducted. What sounds like a good idea at first usually becomes abused. Another possible system is DNA sampling of know, put everyone's DNA signature into a large database, for that "just in case" scenario.
  • no need to avoid TPM as such

    First, some facts:
    TPM chips are nothing more than an smartcart in a chip, soldered on your motherboard (some are removable, in a slot). It does nothing more or less than any smartcard does.

    Now, to say that Windows is more secure when you have TPM is naive. Windows is designed in such a way as to permit execution of any code signed by "special keys". Microsoft claims they are only their own, but folks have found references to NSAKEY in Windows code and ... it was already reported hackers had access to Windows code signing keys ..... so, take all this claims with a grain of salt!
    Windows executes such code without any warning or indication. It's "code from the vendor", trusted...

    Now, some "speculation":
    This alone means that at least Microsoft has the ability to execute any code on your computer. You should already know, that Microsoft is an US corporation, that always follows orders from the US Government. If NSA asks Microsoft to run some software on your computer, they will. And because when NSA asks such things, they provide gag orders, Microsoft will not be able to tell you.
    So make your own opinion out of this. Can NSA run code on your computer, or not.

    end of "speculation".

    The TPM chips have some other "nice" feature. One of the especially "nice" feature of TPM chips is that unlike any sane HSM, they can export keys to another TPM module. Nice eh?
    Also, the TPM module contains an signature fingerprint, which is unique. By virtue of being soldered on your motherboard, it makes for an very handy unique identifier for your computer. Any software on your computer (hint: Windows) that has access to the TPM chip, can transmit this identifier where it chooses... to Microsoft, to let them know what software you have installed (licenses, etc trivialities), or to any web site that asks... kindly enough.
    Further, the TPM chip is a very nice feature that software vendors (including Microsoft) appreciate: it can be used to license specific software to specific computer only. Even make it so that the software can't run on any other computer, even if you copy it, because it lacks the required signature etc..

    There is more, of course....
    • Now this is too funny

      This alone means that at least apple has the ability to execute any code on your computer. You should already know, that apple is an US corporation, that always follows orders from the US Government. If NSA asks apple to run some software on your computer, they will. And because when NSA asks such things, they provide gag orders, apple will not be able to tell you.

      Or do you believe that apple can't run code on your computer? Who exactly do you think wrote osx?

      Too funny, you just can't make this stuff up.
      • You are quite correct.

        ANY system that has a TPM chip under the control of a second party can be controlled by that second party to do whatever that second party wants.

        Since that second party is NOT the system owner, the system owner is vulnerable.