Ruslan Rakhmetov, Security Vision
One of the tasks of cybersecurity is to prevent unauthorised access (abbreviated as intrusion) to protected information. To gain such access, attackers can use a variety of cyberattack techniques, but among them there are some that, with proper training of hackers and in the absence of specific defences, will go unnoticed by both users and IS specialists. Such cyberattacks are aimed at bypassing the established protection measures by directly accessing the disc subsystem of the protected device, booting the operating system from an external drive, or introducing sophisticated, undetectable viruses (bootkits). To counter such cyberattacks, which require a high level of attacker training or even physical access to the device, there is a whole class of specialised protection tools called trusted boot tools, which are the focus of this article.
According to the definition from the FSTEC regulations, a trusted boot tool is a software and hardware tool used for information protection purposes and realising the functions of preventing intrusion into software and (or) technical resources of a computing device at the stage of its booting. In other words, a trusted boot facility (abbreviated as TDF), a trusted boot module (TBM) or a hardware and software trusted boot module (HSPM) is a software or hardware security tool that protects the process of booting an operating system (OS). In accordance with the information letter of FSTEC of Russia No. 240/24/405 dated 06.02.2014 ‘On Approval of Requirements for Trusted Boot Facilities’, the following types of trusted boot facilities are distinguished:
- Means of trusted booting of the basic I/O system level;
- Means of trusted booting of the expansion board level;
- Means of trusted booting of the boot record level.
Let's examine these types of SRS in detail:
1. Basic Input-Output system level trusted boot tools are software SDZs that are embedded into BIOS (Basic Input-Output system) and UEFI (Unified Extensible Firmware Interface) to control the OS boot order, BIOS/UEFI integrity control, authentication and integrity of the OS modules to be loaded (including the OS boot chain, Windows Registry), user authentication (including password, including domain password, certificate on USB token or smart card, iButton (Touch Memory) electronic key), logging of user and SDZ administrator actions. These measures help protect against bootkits - complex viruses that are embedded in BIOS/UEFI, control the operation of the attacked device from the OS boot stage, and can be removed only by rewriting BIOS/UEFI. In addition, SDZs of this type can also protect devices from booting an abnormal OS, for example, from an external drive with a ‘hacked’ OS.
2. Expansion card level trusted booting means are hardware and software SDZs (or APMDZ modules), which are implemented as a separate expansion card of PCI, PCI Express, mini-PCI Express, M.2 standards. Such boards are installed inside the device (server, desktop, laptop) and intercept the device boot order control, excluding OS booting from external drives (flash drives, CD/DVDs, network locations, etc.) and controlling the integrity of the device software and hardware, as well as providing authentication of users before OS booting and journaling of their actions. In addition, a watchdog mechanism is implemented in the ASMDZ, which provides control over the transfer of device control to the SDZ module, and in case of failure performs hardware shutdown of the device power supply. In addition, some APMDZs contain a random number generator, which is used in compatible cryptographic information protection systems to generate reliable cryptographic keys.
3. Boot record level trusted boot means are software SDZs designed to prevent intrusion into information system resources when booting a non-standard operating system or booting from a non-standard boot disc. SDZs of this type use encryption or non-standard reformatting of the master boot record (MBR, Master Boot Record), which occupies the first 512 bytes of the hard disc and contains the OS loader and information about the hard disc partitions, which allows hiding the data about the hard disc partition structure for a user unauthenticated in the SDZ and ensuring inaccessibility of the hard disc partitions when booting from a non-standard OS.
In general, the booting process of a device with SDZ installed consists of the following steps:
1. BIOS/UEFI software performs initialisation of the CPU, RAM, external and internal interfaces of the motherboard;
2. BIOS/UEFI transfers control to the Trusted Boot Module (TBM);
3. SDB performs self integrity checking, authenticates the user by means of the authentication means presented by the user (password, USB token, smart card, iButton electronic key), logs the actions performed, and verifies the authenticity of the OS modules to be loaded;
4. The SDZ transfers control to the OS loader.
As an example of Russian SDZs, some of which entered the domestic IS market in the late 90s, the following solutions can be listed:
- Accord-AMDZ
- Sobol PAK
- Dallas Lock
- ViPNet SafeBoot
- APMDZ KRYPTON-LOCK
- Aladdin Trusted Security Module
However, the concept of trusted boot and dedicated hardware devices for its provision has long been used abroad as well - there they are called Trusted Platform Modules or Trusted Platform Module (abbreviated as TPM-modules). Such modules are miniature cryptoprocessors used for cryptographic key generation, encryption, decryption and digital signature of data, as well as equipped with built-in non-volatile memory for storing data (cryptographic keys, certificates, service information) and a random number generator. TPM modules are supported in Windows family operating systems starting from Windows Vista and Windows Server 2008, the current actual version of the TPM specification is 2.0, revision 01.59. TPM modules can be discrete (placed on the motherboard as a separate chip) or integrated into the CPU (technologies called Intel Platform Trust Technology and AMD fTPM).
The popularity of TPM chips increased dramatically in mid-2021 with the release of Windows 11, which requires TPM to be installed - news of this requirement even led to a shortage of discrete TPM modules on the market for a while. TPM functionality is the basis for many methods of protecting devices from physical attacks and sophisticated viruses (bootkits): for example, the TPM module provides reliable operation of Secure Boot technology to control the integrity and authenticity of UEFI, the OS boot loader, and critical OS components (including the OS kernel, OS kernel modules, and device drivers). In addition, the TPM module has built-in protection against unauthorised access and malicious influence on the data stored in it.
Another function of the TPM module in Windows family operating systems is to manage Windows BitLocker data encryption technology, which allows full-disk encryption of drives and prevents access to data on the hard drive when attempting to boot a third-party operating system from external drives, when changing the hardware configuration of the device, or when attempting to access the hard drive after installing it in another device. In Linux-based systems, Linux Unified Key Setup (LUKS) drive encryption technology also supports the use of TPM chips to manage drive encryption keys.
In conclusion, here are some practically useful tips for security administrators on how to use the native functionality of devices and modern operating systems:
1. Secure Boot technology is supported in Windows and Linux, but may be disabled by default in UEFI, so it is recommended to enable and configure it to use the TPM module;
2. When using full-disk encryption technologies (BitLocker, LUKS), you should use the TPM-module functionality, set an additional strong password to unlock access to the encrypted disc (TPM+PIN), and ensure safe storage of BitLocker and LUKS recovery keys;
3. When using Windows BitLocker, it is not recommended to activate the Network Unlock functionality (automatic BitLocker unlocking when the device is in the domain network) - if it is necessary to reboot the device without involving the user to enter the password (in case of using the TPM+PIN scheme), you can use the standard ‘suspend BitLocker’ functionality;
4. In the BIOS/UEFI settings you should set the correct boot order (first - the hard disc with the OS), disable PXE and Wake-on-LAN functionality (if not used), as well as set a password to change the BIOS/UEFI settings - this simple measure will prevent intruders from changing the boot order;
5. It is recommended to seal the device cases with special holographic stickers, which are destroyed when attempting to open the cases and can serve as evidence of attempts of unauthorised access to their ‘innards’.
