Windows 8 and TPM: a frustrating tale of astonishing stupidity
(thread renamed upon encouragement by Jerry 
)
tl;dr version: Windows 8 automatically enables a Trusted Platform Module if it finds one. This is a change from Windows 7. If the manufacturer of your computer has already placed a certificate in the TPM, and that certificate has expired, then when Windows 8 activates the TPM, your computer's motherboard will brick itself.
Lengthier message thread follows, anonymized and annotated.
My thoughts... I have come to loathe hardware-based root of trust. Secure Boot and TPM present serious risks that can render hardware investments instantly useless and block access to your own information. These risks far outweigh the security risks that the technologies purport to mitigate.
)tl;dr version: Windows 8 automatically enables a Trusted Platform Module if it finds one. This is a change from Windows 7. If the manufacturer of your computer has already placed a certificate in the TPM, and that certificate has expired, then when Windows 8 activates the TPM, your computer's motherboard will brick itself.
Lengthier message thread follows, anonymized and annotated.
From: Alice (owner of an Intel Classmate laptop)
[At this point, it's natural to assume, since the problem was caused by Windows 8, that the problem is related to UEFI secure boot. The real problem lies elsewhere.]
From: Bob (small business computer consultant)
[I don't know what "security structures" are. Presumably Bob means the TPM here.]
From: Alice
From: Bob
From: Charlie (OEM manufacturer and channel vendor)
From: Alice
From: Debra (a well-connected member of the SBS community)
From: Alice
[Note Alice's observation: Windows 7 will cause the same problem if the user attempts to enable the TPM and that TPM contains an expired certificate.]
So Windows 8 killed my Nobi. The Nobi is the Intel Classmate PC tablet that I travel with. The secure boot feature has apparently locked the BIOS from booting any OS at all. Even after the hard drive has been reloaded with Windows 7. They are telling me the only way out is a new motherboard. This is what I get for my trouble to join the Consumer Preview program.
I would be very careful about loading Windows 8 onto any computer that is capable of using the secure boot feature. This one apparently is, but the certificate on the motherboard is expired and so Windows 8 has locked the BIOS somehow, someway. Interesting feature.
I would be very careful about loading Windows 8 onto any computer that is capable of using the secure boot feature. This one apparently is, but the certificate on the motherboard is expired and so Windows 8 has locked the BIOS somehow, someway. Interesting feature.
From: Bob (small business computer consultant)
I don't believe it to be the software that broke things. We have seen some strange behaviours on Intel's Spring Peak notebook line that uses similar "security" structures. Thus the RMA question as we have seen users locked out of their units because the onboard security measures kicked in.
Intel's warranty period is normally three years. An Intel partner that participates in the Classmate PC program should be able to RMA it for you and get that board replaced.
Intel's warranty period is normally three years. An Intel partner that participates in the Classmate PC program should be able to RMA it for you and get that board replaced.
From: Alice
The Nobi had a one year warranty which is probably two years past. They want $150 for a new board but the new board will have the same problem. I won’t be able to load Windows 8 on it ever.
Wow. I wonder if Intel is aware of the potential problem this could have as there are a lot of those ClassMate PCs out there? I stand corrected. Something bad going on between the OS and the TPM/security structures built into the motherboard.
The BIOS cannot be flashed. The motherboard bricked when you tried to install Windows 8.
I believe Intel is aware of this. I have forwarded your questions to them to answer. However, meanwhile there is no solution besides replacing the motherboard. The last time it happened, Intel simply told us Windows 8 is not compatible with this device therefore should not be loaded.
I believe Intel is aware of this. I have forwarded your questions to them to answer. However, meanwhile there is no solution besides replacing the motherboard. The last time it happened, Intel simply told us Windows 8 is not compatible with this device therefore should not be loaded.
Here is where we stand. I could use some awesome Intel and Windows 8 contacts to help me get my Nobi back and help all of those schools (mainly) that also own the Classmate PCs and are about to have a huge problem.
Since it's nearly free for schools and Windows 8 has the same specifications [as Windows 7] and it's made for tablets, I expect that they will [attempt to upgrade]. Or at least enough of them will that having student PCs turned into bricks that need new motherboards will be a publicity nightmare that could cost them the whole market. If anyone besides SBS [Small Business Server] people are known for talking to one another, it's schools.
Since it's nearly free for schools and Windows 8 has the same specifications [as Windows 7] and it's made for tablets, I expect that they will [attempt to upgrade]. Or at least enough of them will that having student PCs turned into bricks that need new motherboards will be a publicity nightmare that could cost them the whole market. If anyone besides SBS [Small Business Server] people are known for talking to one another, it's schools.
Dustin Ingalls (author of the Building Windows 8 blog post "Protecting your digital identity") has reached out via the Win8 list and has asked to be introduced to Alice. He's not aware of any Intel based PC that can be bricked but wants to know the specs of exactly what it is.
I just talked to Dustin. He now understands the problem and why the system is bricked. Intel has installed a certificate in the TPM as an anti-theft measure. However, that certificate has now expired and the only way to get around it is to enter a ten-digit code which Intel is not giving up. Perhaps because they used the same ten-digit code on all seven million tablets -- time will tell. Windows 8 invoked this problem because it apparently automatically provisions the TPM chip should you have one. Since it did that, this caused the TPM to check its certificate and brick the system. This problem would not be unique to Windows 8, it could also occur if someone decided to enable TPM today in any OS. He is looking for the right person at Intel and is appalled at this implementation of TPM. So am I.
Comment