Pluton Processor – New Mandatory Windows Requirement?

General Discussion (off topic) Anything and everyt
1

Hi All,

Microsoft, in partnership with CPU manufacturers, is planning to introduce a new security protocol called Pluton which is similar to TPM but built into the processor and, if history is anything to go by, there’s every likelihood it could end up being a mandatory requirement.

Reading Microsoft’s dissertation it seems that Pluton provides the same, or very similar, functionality as TPM. The problem with TPM, according to Microsoft, is that the data flow between the TPM chip and the CPU creates a channel of communication that’s open to exploitation. Building the same functionality directly into the CPU eliminates that channel and therefore also eliminates the potential for exploitation.

In short, Microsoft has gone from… TPM is the ultimate in security that every user needs –to– TPM is vulnerable so the new best thing is now Pluton.

Attackers have begun to innovate ways to attack TPM, particularly in situations where an attacker can steal or temporarily gain physical access to a PC. These sophisticated attack techniques target the communication channel between the CPU and TPM, which is typically a bus interface. This bus interface provides the ability to share information between the main CPU and security processor, but it also provides an opportunity for attackers to steal or modify information in-transit using a physical attack. The Pluton design removes the potential for that communication channel to be attacked by building security directly into the CPU

2

That’s good, it moves the computer repair shops…

3

Hi,
Microsoft Pluton Security Processor

  • Microsoft Pluton security processor
    The Microsoft Pluton Security Chip is a chip-to-cloud security technology designed with Zero Trust principles at its core. Microsoft Pluton provides hardware-based root of trust, secure identity, secure attestation, and encryption services. Pluton technology is a combination of a secure subsystem that is part of the system-on-chip (SoC) and software created by Microsoft that runs on this embedded secure subsystem.

Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 processors. Microsoft Pluton can be enabled on devices with pluton processors running Windows 11, version 22H2.

  • What is Microsoft Pluton ?
    Designed by Microsoft and engineered by silicon partners, Microsoft Pluton is a secure crypto processor built into the processor to provide security at the core of the code to ensure code integrity and the latest protection with updates provided by Microsoft through Windows Update. Pluton protects credentials, identities, personal data, and encryption keys. Information is much harder to remove, even if an attacker has installed malware or has full physical possession of the PC.

Microsoft Pluton is designed to provide Trusted Platform Module functionality as well as provide other security functionality beyond what is possible with the TPM 2.0 specification, and enables the provision of additional pluton firmware and system functionality operating over time via Windows Update.

Pluton builds on proven technology used in Xbox and Azure Sphere, and provides enhanced built-in security features for Windows 11 devices in collaboration with leading silicon partners.

Pluton architecture 1
Pluton architecture 1786×422 61 KB

The Pluton Security subsystem consists of the following layers:

Description

Material:
Pluton Security Processor is a secure element tightly integrated with the SoC subsystem. It provides a trusted runtime environment while providing the necessary encryption services to protect sensitive resources and critical items such as keys, data, etc.

Firmware:
Microsoft-authorized firmware provides the required secure features and functionality, and exposes the interfaces that operating system software and applications can use to interact with Pluton. The firmware is stored in flash storage available on the motherboard. When the system boots, the firmware is loaded as part of the Pluton Hardware initialization. When Windows starts, a copy of this firmware (or the latest firmware obtained from Windows Update, if available) is loaded into the operating system.

Software:
Operating system drivers and applications available to an end user to enable seamless use of the hardware features provided by the Pluton security subsystem.

Firmware upload flow:
At system startup, Pluton hardware initialization is performed by loading the Pluton firmware from the Serial Peripheral Interface (SPI) flash storage available on the motherboard. However, when starting Windows, the latest version of the Pluton firmware is used by the operating system. If newer firmware is not available, Windows uses the firmware that was loaded during hardware initialization. The diagram below illustrates this process:

Pluton architecture init
Pluton architecture init741×727 62.1 KB

Knowing that the A.I (Artificial Intelligence) will grow and that hackers will certainly not miss it.

In the next 2 years (and future of course), the security of PC data will certainly be a considerable issue, hence the important reflection on the equipment to be acquired soon as well as the software, including security (hackers are already at work trying to intercept data via TPM).

ZorKas

4

Interesting. I think we’re some years out before it’s a requirement for Windows O/S. Dell and Lenovo have opted out of PCs with this processor.

5

Block tomorrow’s attacks

This new chip is designed to block new and emerging attack vectors that are used to compromise PCs, including CPU security vulnerabilities like Specter and Meltdown. Pluton is an even bigger step in securing CPUs and Windows PCs in general.

Legacy TPMs are separate from CPUs, and hackers have also developed methods to steal the data and information that flows between a TPM and a CPU when they have physical access to a device. Just as it is not easy to hack an Xbox One to run pirated games, it is hoped that it will be much more difficult to physically hack a Windows PC in the future by integrating Pluton into the CPU.

Chip-to-cloud-security

Microsoft’s work with Intel, AMD and Qualcomm also means that Pluton will be updated from the cloud. Updates will be released monthly, on the same day as the Thueaday Patch dedicated to traditional Windows fixes.
Integration into future processors

It’s not yet clear when PCs with Pluton chips will start shipping, but Intel, AMD, and Qualcomm are all committing to integrating the feature into their future processors. It will still be possible to build custom PCs with embedded Pluton chips, and there should even be Linux support in the future.

Microsoft, Intel, AMD, and Qualcomm all believe that processors that are continually updated with built-in security are the future of Windows PCs. Specter and Meltdown have been a wake-up call for the entire industry, and Pluton is a significant response to the complex security threats facing modern PCs today.

Comodo must take these developments into account

1 Like
6

Agreed, chips need to evolve and be more secure.

Hopefully Comodo will follow these developments. Still hopeful of a summer update. I’ve yet to try out Xcitium Free EDR

Anyway, looking forward to seeing how this chip technology develops and how it’s implemented.

The chip in my laptop Intel 12500H

1 Like
7

The approach is no different in the PC world. The idea is to place the hardware root of trust in the processor, rather than relying on a physical TPM (Trusted Platform Module). The removal of this annex chip – whose capabilities remain accessible by emulation – is supposed to reduce the attack surface by eliminating a weak point: the communication bus with the CPU. In the background, interception attacks on this bus. One of them, particularly publicized last summer, had made it possible to recover, in half an hour, the BitLocker key of a Lenovo laptop. This had a TPM, a BIOS password, Secure Boot enabled and the hard drive fully encrypted.

Placing the hardware root of trust as close as possible to the CPU is supposed to reduce the attack surface, by eliminating the communication bus and the risks of interception that go with it.

Comodo 2024 must imperatively take into account this new advance in terms of security.

8

For now, I will settle for a June 2023 delivery of a Comodo 2023 release including fixes to the known bugs list.

9

Fixing current bugs and the future of technology-related protection must merge
Comodo must prepare protection according to new technology processors

10

seems similar to faronics Deep Freeze on a basic level of security.