News: 1605640505

Microsoft has joined hands with Intel, AMD, and Qualcomm to release a new security chip called Pluton, which Redmond reckons will delete "entire vectors of attack" from the infosec landscape.

"Our vision for the future of Windows PCs is security at the very core, built into the CPU, for a more integrated approach where the hardware and software are tightly integrated, ultimately removing entire vectors of attack," said Microsfot [1]in a blog post this afternoon.

The "chip to cloud security technology", as Microsoft calls it, will be integrated into future CPU designs and is intended to defend against physical security attacks as well as preventing "the theft of credential and encryption keys", Microsoft added.

Conceptually, the Pluton architecture is an extension of hardware security work that Microsoft started in 2013 with onboard anti-piracy protections for the Xbox One console ( [2]with roots in the early 2000s ), though in case that sounds dangerously consumerish the firm is also keen to say the same approach was ported across to Arm-based system-on-chip IoT thingy [3]Azure Sphere too.

Future CPU designs from AMD, Intel, and Qualcomm will incorporate Pluton technology, with all three chipmakers queuing up to dutifully say what a great idea this is: "We believe an on-die, hardware-based Root-of-Trust like the Microsoft Pluton is an important component in securing multiple use cases and the devices enabling them," stated Asaf Shen, Qualcomm's senior director of product management in a prepared remark.

Trusted Platform Modules (TPMs) form the current root of Windows PC defences and are separate from existing CPU designs. Microsoft hopes to remove that distinction by adding the root-of-trust component directly into the silicon.

"Windows PCs using the Pluton architecture will first emulate a TPM that works with the existing TPM specifications and APIs which will allow customers to immediately benefit from enhanced security for Windows features that rely on TPMs like BitLocker and System Guard," said Microsoft. In theory, this means anything using a TPM today should be able to run on a Pluton-fitted CPU in the future.

It appears that Redmond's intent with Pluton is to better tackle more advanced PC and enterprise-level attack vectors that have emerged in recent years, something no longer confined solely to malicious people with physical access to your hardware. In its post Microsoft claimed: "Windows devices with Pluton will use the Pluton security processor to protect credentials, user identities, encryption keys, and personal data. None of this information can be removed from Pluton even if an attacker has installed malware or has complete physical possession of the PC."

Such boasts tend to spur on research from white and black hats alike determined to disprove them, though it's very early days.

Last year academics discovered that Windows TPMs, previously an important part of Windows' out-of-the-box defences, [4]leaked timing information that allowed attackers to remotely recover cryptographic private keys . Similarly, other research (MS cited a [5]blog post from infosec outfit Pulse Security) has shown how the bus between the CPU and the TPM can be successfully sniffed – albeit in the context of a hardware hack.

Pluton also appears intended to complement Microsoft's existing secured-core PC firmware-level security initiative which it [6]announced last year , and which are said to "combine identity, virtualization, operating system, hardware and firmware protection" in a concerted effort to shut out attackers. ®

Get our [7]Tech Resources



[1] https://www.microsoft.com/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs/

[2] https://www.theregister.com/2005/08/30/infineon_xbox_360_chips/

[3] https://www.theregister.com/2020/02/24/azure_sphere_is_now_generally_available/

[4] https://www.theregister.com/2019/11/12/don/

[5] https://pulsesecurity.co.nz/articles/TPM-sniffing

[6] https://www.theregister.com/2019/10/22/microsoft_securecore_pcs/

[7] https://whitepapers.theregister.com/