[Cryptography] Cheap forensic recorder

[Natanael]

On Tue, Mar 3, 2015 at 6:56 PM, Phillip Hallam-Baker
<phill at hallambaker.com> wrote:
>
>
> On Mon, Mar 2, 2015 at 10:59 PM, Emin Gün Sirer <el33th4x0r at gmail.com>
> wrote:
>>
>>
>>>
>>> 1) We make the hardware and seal it in some sort of tamper evident resin.
>>
>>
>> You can buy that today. Here's the specs for that chip seated in resin:
>> http://www.trustedcomputinggroup.org/resources/tpm_main_specification
>
>
> Err where do I plug in the keyboard and screen? How do I use this system to
> make the forensic investigation from?
>
> Can I pull content off YouTube and watch it? Can I pull data off a hard
> drive?

The USB Armory is capable of all that.

> A TPM is designed to permit trusted code implementing a small number of very
> security critical functions to operate in a trusted environment. Things like
> public key crypto and such.

Possible if you want to configure it that way.

> A TPM does not and cannot protect every O/S function and applications have
> to be specially written to make use of it.

Same here. The TrustZone runs what you tell it to run. You can chose
to run everything there or just very little. You can run your logger
inside it. You can run code that protects the OS integrity. Or
anything else. Your choice.