Re: Comodo Personal Firewall

"That's not true. While PCs are using CPUs which are von Neumann style,
and
don't have two types of memory for separating code and data (like i.e.
CPUs
with Harvard architecture), PC hardware is not more insecure than other

comparable hardware. The problem is with Microsoft Windows. "

VB, my statement is not about PC Hardware as such but the CPU
architecture..Let me try to explain what I mean: (First of all, I, in
the good old days did device driver development, I am an electronic
engineer and have got involved in the design of many security hardware
and 2 security Chips ). In my younger years, they could not build a
dongle that we couldn't get into with a decent debugger (like softice).
The issue is you can watch every instruction and its data by looking at
the CPU registers. Thats where the inherent weakness is. So everything
else that relies on that infrastructure is, to a level, flawed. Of
course for one to claim insecurity, one must define the threat model,
otherwise we could be talking about totally different scenerios and
without proper defintion of a threat model we can't possibly say the
security is reasonable or not. Anyway, my statement was based upon the
structure of almost every single CPU (or microcontroller) I worked with
(from 8086 based CPUs to Z80 to PICs) (Yes we did build a security chip
using a Z80 core and worked nicely :-) and guess what we could not
debug it cos the chip was built in a way it did not allow you to debug
it! (the only way was for you to use a special acid to take the
packaging of the chip off to expose the silicon and its connections to
the pins and somehow try to connect it so that u could have access to
its registers ) If you have access to the PC you have access to
anything software on that machine cos you can have access to registers
and with time you can figure out whatever it is you want to figure out.
There used to a be good website with lots of useful info in reverse
engineering called Fravia (check google for "Fravia reverse
engineering", there still might be some people carrying the tradition
forward :-) ). I understand your answer about the data and code
protection but thats not what i was referring to.

.

Relevant Pages
Quantcast