7

I'm a reasonably computer-savvy user who dual boots Linux and Windows 10, and I'm interested in security against malware, remote exploits, etc. on my home desktop. At least in theory, could a Trusted Platform Module (TPM) provide any protection against any of those threats? In practice?

I've spent a fair amount of time reading about TPMs, but I can't get a clear picture about how exactly it would help me (or most people for that matter). It clearly has benefits if you want full-disk encryption, but what what use is a TPM for a home user beyond full-disk encryption? I can find information on how to secure my SSH keys with a TPM, but I'm not sure what good that would do.

lnmaurer
  • 185

1 Answers1

7

It looks like you already understand full-disk encryption, so I'll not go into that.

Correctly configured, a Trusted Platform Module can protect you from certain specialized types of malware. Some particularly nasty malware rewrites your bootloader for one of two purposes:

  1. Do bad things before any antivirus application can do anything about it. Example: TLD4
  2. Virtualize your entire OS so that it can spy on everything you do without being detectable by normal means (i.e. it's very difficult for the online system to detect that such things are going on). Example: Blue Pill

TPMs can shield you from these by establishing a chain of trust: verifying the boot loader, which then can start an approved antimalware solution (Early Launch Anti-Malware), which then defends you from normal viruses. This is where the name "Trusted Platform Module" comes in; the TPM verifies that your OS's platform hasn't been tampered with.

If the bootloader has been modified (i.e. is not signed by a trusted authority), the TPM can refuse to provide the information needed to boot the system, and you'll need to repair your OS installation manually. This protection is referred to as Trusted Boot.

Once the OS is up and running, though, your protection must be provided by a normal anti-malware program. A TPM can't stop you from getting infected by normal viruses.

Secure Boot

UEFI has a feature called Secure Boot that does something similar, and doesn't necessarily involve the TPM (TechNet source):

Secure Boot does not require a Trusted Platform Module (TPM).

Secure Boot and Trusted Boot are not the same thing! Trusted Boot provides details of the boot process to the OS, while Secure Boot just verifies the bootloader before starting it. Modern OSes - Windows from Windows 8 up, most Linux distros - support Secure Boot. The details on how to set it up vary based on machine firmware and OS, but there's generally a fairly obvious "Secure Boot" setting in your machine setup screens.

References: Windows 8.1 Boot Security, Enabling Secure Boot in Windows 8. Windows 8.1 Boot Process, UEFI Secure Boot and the TPM

Ben N
  • 42,308