Where does the root of trust actually lie?

Question

We are told that the roots of trust in the PKI are the handful of Certificate Authorities that issue root certificates and sign other certificates and ensure at least some extent of trust to be maintained on the internet.

These root certificates come pre-installed on most modern operating systems. This provokes the thought that it is not the root CA that we're trusting, but the entity/entities that provide us that root CA, which may be the manufacturer, the operating system developer, or even the seller that sold the device.

To explain my point, I provide this hypothetical example. Let's say that Julian Assange, while hiding in the Ecuadorian embassy, decides to buy a new Thinkpad on a famous e-commerce website. Now famous e-commerce website, like countless other American organizations, collaborates with the NSA on data sharing. The NSA learns of Assange buying a new laptop, and decides to "bug" that laptop with a fake root CA (and a bugged TPM). The package is delivered in brand new condition, and Assange begins to use his laptop.

It turns out that the Ecuadorian embassy's network was 'pwned' by the NSA long ago. Assange's network traffic was going through NSA's systems for quite a while, but the saving grace was that the traffic was at least encrypted. Now, with the fake root CA, the NSA is successfully able to mount a Man in the Middle attack, being able to see the traffic in plaintext, with perhaps the exception of PGP encrypted e-mails.

Even if Assange tries to download new Root Certificates to ensure being on the safe side, the traffic is intercepted by the NSA, and fake certificates are inserted.

---

Now, you might reasonably argue that the aforementioned 3-letter-agency (and its equivalents everywhere) do not have enough funds, reasons, or legal authority to target most of us, but this might be a realistic scenario for many of the activists, or perhaps very lucrative targets such as data centers/companies that might end up buying a system bugged with fake root CA.

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?

Additionally, are there any books, research papers, etc, that discuss this threat model in detail?

Answer 1

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?

The attack in the hypothetical example that you describe relies on a fraudulent certificate having been installed on the system before the system was delivered to the victim.

To mitigate an attack of this nature, it's best to not trust someone else to install the operating system. Instead, wipe the hard drive clean, and install an OS that you trust on the system from scratch, using an ISO from a distributor that you trust. And, proceed with the installation only after you have verified the distributor's signature on the ISO.

Answer 2

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?

One way to avoid being the target is to not do anything that would spike the interest of intelligence agencies. It won't prevent you from being caught in the collateral damage of the agencies targeting somebody around you though...

More seriously, for an individual, there is no easy way to detect or thwart such an attack, as the resources of the attacker far outmatch your own. An intelligence agency won't just add a root CA to computer if they have a chance to tamper with your hardware. That would have too easy to detect/mitigate. They will likely install some hardware backdoor and/or persistent malware.

You could reinstall the operating system, but this wouldn't prevent advanced firmware-resident malware from reinfecting you. You could check the certificate fingerprints, but the malware would simply hide the fingerprint of the malicious certificates and instead display the fingerprint of the real certificate. The cost of detecting and removing any hardware backdoors is prohibitively high.

An individual's best bet against such an adversary is to not get compromised hardware in the first place. Instead of ordering the laptop online (which makes it very convenient for a TLA to intercept and modify), purchase it from a brick and mortar store in cash. Additionally, make sure the store is some distance away from where you live (far away enough that the adversary cannot easily predict you will go there).

Answer 3

The root CA list is not hardware-based (in the general case, see about the TPM below). It comes as a built-in feature of your operating system.

Other software (e.g. browsers, mail clients, etc...) may either use the OS provided list or have their own.

These lists are once in a while updated by the software vendors with whatever security update process they have in place.

In general, you trust the vendors of your software and the root CAs.

Why they are at all trustworthy - well, they are trustworthy to an extent. See here.

---

People with computer security related work are highly unlikely to use the preinstalled software on their new computer.

What they do is to install an OS with an acceptable security track record and they check the installation media first (by its fingerprint or signature).

(Of course, this is not the whole story, but only a good outline.)

---

In regard to the TPM module:

For the average Assange residing in the average Ecuadorian embassy,the TPM module in their computer is a security risk in itself, just like any unauditable blackbox related to the information security. They do everything they can to remove, disable or at least exclude the TPM module from their chain of trust.

Answer 4

TLDR: Check fingerprints of certificates on your device.

All certificates, not only root ones, have fingerprints. These fingerprints are publicly known. If you have any doubts about certificates on your particular device, you can compare their fingerprints with known values. For instance, you can use several other devices and from each one access several resources where information about particular certificates is published. Also you can contact some friends who can do it for you. And so on. Technically it is impossible to break all channels and replace real data with desired fingerprints of the fake certificates.

Thus, you will know the fingerprint of the correct certificate. Then compare it to the fingerprint of certificate on your device. If it does not match, this will mean that certificate on your device is fake.

Besides, fake certificates make sense only in one case, when somebody fully controls connection between your device and the Internet. If you can connect to the Internet via networks that are not controlled by the attacker, your browser will obtain the real certificates from the target web sites. Your browser will complain that their certificates are not trusted, because they differ from what is installed on your device. Latest then you will check certificates on your device and certificates on the target web sites, and you will see that actually certificates on your devices are fakes.

Answer 5

What you describe is a supply chain attack. And it is something relatively hard to protect from.

what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?

The easiest way to avoid being targeted is to avoid being detected as the target. So, if you were Julian Assange, don't order the computer as "Julian Assange", and don't ask for it to be delivered to the Ecuadorian embassy.

Even better, don't order it, but go to a shop (or have someone trusted go in your place) and buy a random ThinkPad of those they have on display. If your attacker doesn't know which computer you are going to buy (or even which commerce!), they cannot bug your computer. They would need to bug all the computers of the shop. Moreover, someone else buying one of those could be noticeable.¹ If you are an important enough target, we can imagine even creating a fake shop just to sell a single compromised computer, but the complexity is much higher than compromising just "the computer for Julian Assange".

Basically for the same reason, there is a story that Trump likes to eat at McDonald's -among other things- to avoid being poisoned, since nobody knows he's going there, or which burger he's going to eat.

If you are a company or government trying to avoid this (e.g. if the Kremlin wanted to buy American computers), they would use a number of intermediaries to obscure the real buyer.

Moreover, companies would probably not use the preinstalled OS, but its own image (for other reasons, but actually helping with this). An end user could do the same, by installing a new OS from a trusted source (in fact, a compromised OS or browser could be more useful than merely a compromised CA store). Which moves the target from having a trusted software preinstalled to getting a copy of non-compromised software. If you already somehow have a trusted machine, you can use that to bootstrap (such as figuring the right fingerprints, and calculating it with a non-compromised tools).

If you need to install a tool with no prior toolset that can be trusted not to have been compromised. Even if you manually check fingerprints, you cannot be sure that the software that is calculating such fingerprint isn't lying to you.

¹ They could simply add duplicate CA certificates, so that innocent customers would not get certificate errors when using a network not compromised by the Agency, but it's not desirable for them that a Greenwald notices that shop X is selling compromised computers.