Incidentally, the key's out already.
http://semthex.freeflux.net/blog/
The fellow who developed this workaround isn't distributing it, but
others surely will. Given that anyone who owns an Intel Mac has a
copy of the TPM key, it's a good bet that someone who isn't afraid to
break the DMCA (or simply lives in a country where it doesn't apply)
will do so shortly.

On 10/28/06, Jim Foraker wrote:
> On 10/27/06, Mark Senior wrote:

> > And, I suspect using encrypted binaries might in fact gain you
> > something - as long as the AES key is only distributed underground,
> > legitimate researchers mostly won't have access to it. So, any
> Legitimate researchers are not that bad at getting their hands on
> underground tools, once they're known to exist. And if the key gets
> out, it probably won't stay a well-guarded secret for long: too many
> folks want to run OSX on non-Apple hardware.

They may be able to get their hands on the key, but their hands would
be tied by laws such as the DMCA. Circumventing a DRM mechanism is
illegal - the reason for circumventing (e.g. to reverse engineer a
virus) is irrelevant, as is the fact that the DRM mechanism already
had to be circumvented in order to create the target of study.

> > AES-encrypted binaries would be much more difficult for the good guys
> > to reverse-engineer, to figure out what the bad guys are up to.
> More difficult, yes. Given that the OS will happily decrypt the
> segment for you though, I suspect that there are tools that can be
> written to work around the problem.

Yes, but as I understood it the the kernel will only decrypt the
segment to map it to executable memory. The kernel will let you run
an encrypted virus, just not study it.
http://osxbook.com/book/bonus/chapter7/binaryprotection/

You could possibly do some clever trick like load it into a debugger,
not start the execution, and then dump the core as plaintext. But
that's a lot of trouble, and it's also somewhat risky - you want to
treat suspicious code with a circumspection...

Tools to simply decrypt the file without letting it anywhere near an
execution pointer could easily be written, but technical ease and good
motivation for writing such tools doesn't make them legal under the
DMCA.

[ reply ]