SCRT Blog

https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniff… https://post-cyberlabs.github.io/Offensive-security-publications/posts… Yes, the PIN is entangled with the key material. The admin PIN recovery techniques all involve enrolling additional unlocking methods. Besides this, I completely agree with this post, especially: > I think the best you can do right now is to layer a password with a hardware device. I don't think saying that the hardware devices are flawed means they are not useful as PART OF the security setup. It would certainly be nice if the software did this automatically/easily and it's unclear to me why it does not. I've always found it silly that Microsoft's default BitLocker implementation doesn't make it easy to do the obvious thing that FileVault does and use the user's password as an additional wrapper to encrypt the KEK. Yes, then there's trouble when the user forgets their password and password-change rotation is a little annoying, but if you're in an enterprise scenario you need backup keys anyway, and your users are still as likely to get BitLocker'd by PCRs changing (ie due to EFI updates) than forgetting a password anyway.

I was given this article after posting the previous one elsewhere: https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniff… This one does say "it appears that the user’s PIN is sent to the TPM which releases the intermediate key only if the provided secret is correct, thus effectively preventing offline bruteforce attacks." Given this, I can't see how it would be possible for anything like YellowKey to work on a cold booted TPM+PIN system without someone already knowing the PIN. Perhaps when the exploit author said "it works with PIN" they meant "it works if you enter the correct PIN"... or they are just lying. I'm not sure.

Found the article where I read about PCR 7+11 being the default [1]. The reason I looked it up is because if this is actually true, and the TPM is built into the cpu, what prevents someone from placing the cpu and disk on another motherboard? Say that you have disabled usb booting and secured UEFI settings with a password. If you extract the cpu (and thereby its tpm) and the disk, then you'd still be able to boot, right? Meaning that without a TPM pin, you'd be able to do OP's attack on a different motherboard even when the original machine was off and UEFI settings secured. What am I missing? Is it that easy to circumvent UEFI settings protection and maintain the PCR 7 value? [1] https://blog.scrt.ch/2023/09/15/a-deep-dive-into-tpm-based-bitlocker-d…

Still pointless when the key can be sniffed in cleartext by intercepting the communication between the TPM and the CPU [1]. You should always combine it with something only known to the user (i.e. a passphrase). The only attack TPM-backed disk encryption prevents is someone imaging the disk. [1] https://blog.scrt.ch/2021/11/15/tpm-sniffing/

Did you read any of my referenced links? You cannot state this when the paper and well known attack methods disprove your statement. Bitlocker does not store the keys in the CPU, otherwise a coldboot attack while literally transplanting the physical memory rows to a different machine wouldn't work. And it does. In case you are confusing CPU with a TPM chip, which can optionally store the master volume key but only for activated full disk encryption: With TPM you can easily bypass that, too, with tools that can read the i2c bus. See here [1] [1] https://blog.scrt.ch/2021/11/15/tpm-sniffing/

Indeed! Voltage glitching was used to jailbreak Tesla recently! I believe it was also used to jailbreak the Nintendo Switch. If a discrete TPM (separate chip on the mobo, rather than an fTPM which runs in the CPU/SoC) is in use, one can also use bus sniffing to pwn TPM protection: https://blog.scrt.ch/2021/11/15/tpm-sniffing/

At least on my machine, those DLLs are signed (by Intel) - they are just not signed by Mozilla and are not a part of the OS. What you want is already almost possible* in theory, Windows can run code as a Protected Process[1] (even multiple types of them) which not only prevent the loading of non-signed DLLs, but code injection by third party processes (as you can't get a process handle with write access to it's memory). *) "almost" as there are ways to still sometimes circumvent those protections and force loading unsigned code, at least for the newer Protected Processes Light, see e.g. https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland/ [1] https://web.archive.org/web/20220401133647/https://download.microsoft.… (Yes, it's really a .doc)