Pulse Security Blog

Sniffing the TPM's been available for quite some time, actually - and quite cheap! https://pulsesecurity.co.nz/articles/TPM-sniffing The best way would be to arguably keep the key completely off the TPM and use remote attestation. There's some preboot products out there like WinMagic SecureDoc* that use a little Linux partition, spin up just enough to get a network connection up to a remote server, provide authentication services, and then send the Bitlocker key down, unlock the partition, and chainload onwards to Windows. * I acquired an enterprise device on eBay and was VERY surprised to find this product on it as the preboot protector. Zero way to crack in from my end, so I applaud it. There's even some MFA solutions they offer around this! https://winmagic.com/en/solutions/mfa-windows-login/

TPM, at least older version <1.2 were still subject to physical key exfil attacks [1] because the chips communications with other parts of the board were done in the clear. So it was/is recommended to use a pin/key and/or recovery key to ensure the security of the data. Unless your only threat model was to protect against common thievery and assume the attack had no technical prowess (and that’s perfectly fine, I do this for my company). Not to mention they were kinda used as a warranty canary for Truecrypt [2]. There were suspicions that nation states may have hardware bypasses worked out. Later there were implementations of hardware encryption found to be vulnerable. So even now bitlicker does everything in software by default. [3] So I understand why FOSS devs would rely more on standard practice (shared keys) with LUKS and not embrace hardware enclave options like TPM. They haven’t been the most reliable over the long term and are harder to patch/fix. [1] https://pulsesecurity.co.nz/articles/TPM-sniffing [2] https://threatpost.com/of-truecrypt-and-warrant-canaries/106355/ [3] https://www.technadu.com/bitlocker-to-use-software-encryption-on-windo…

You do know those are trivially bypassed with a signal processor, right? If physical access is outside your threat model, that's OK, but it makes (for example) the forced Win11 upgrade for DRM^H^H^H boot integrity enforcement seem ridiculous. https://pulsesecurity.co.nz/articles/TPM-sniffing

The "mitigation" itself is still not very safe if you're paranoid about governments or very motivated organisations. The extra step of checking PCR12 is performed by the initrd that you trust because it's signed by a private key that has probably leaked to every serious hacking corp / government. They can just boot their own signed initrd and kindly ask the TPM that will oblige. I personally replace the firmware certificates (PK, KEK, db, dbx, …) with my own and sign every kernel/initrd update, I also unlock my disks with a passphrase anyways, but I'm on the fence WRT if it's more secure than TPM. Yes in theory TPM key extraction is feasible (and even easy if it's performed by a chip other than your CPU https://pulsesecurity.co.nz/articles/TPM-sniffing ) but it is harder than filming/watching you type the passphrase or installing a discrete key-logger ?

this presumes that anyone would trust bitlocker. https://pulsesecurity.co.nz/articles/TPM-sniffing

> Can you even get the secret from the TPM in recovery mode? Given that you can (relatively trivially) sniff the TPM communication to obtain the key [1], yes it should be possible. Can't verify it though as I've long ago switched to Mac for my primary driver and the old cheesegrater Mac I use as a gaming rig doesn't have a hardware TPM chip. [1] https://pulsesecurity.co.nz/articles/TPM-sniffing

Because of fun probability stuff. The fact what your guessing changes doesn’t matter. It’s still a day to get a correct guess. https://pulsesecurity.co.nz/articles/totp-bruting

I say its more likely the researcher found article from 2019 https://pulsesecurity.co.nz/articles/TPM-sniffing describing this very attack vector using FPGA dev board. The only novel thing here is price point going down by a factor of x10 to $5-10.

I think OP’s point is that singling out BitLocker when the attack is not specific to it is misleading. It leaves the wrong impression that other methods relying on the same key exchange mechanism are safe. Name dropping BitLocker was one sure way to gather attention for something that had been proven years ago, and had already reached a “close enough for all intents and purposes” price point [0]. Not unlike name dropping Tesla or Apple even for mundane things. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing

Yes, and yes - the LPC bus is standardized, and TPMs need to use the same protocol to enable them to be modules on the motherboard. And yes, it's only $10 or thereabouts for a logic analyzer that can decode LPC bus communications. 2019 ref - https://pulsesecurity.co.nz/articles/TPM-sniffing

You can generally sniff the LPC bus to the TPM. Even with TPM2.0+ that allows optional encryption on the transport layer, Windows dosn't bother using it. https://pulsesecurity.co.nz/articles/TPM-sniffing But I was referring more to a malicious software component between the data flow between the user interface and the TPM, even before the TPM's protocol stack is in the loop.

> If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash. You can't easily do that as the platform control headers will be different to those set by Windows. You can't brute-force it as they have a realtime clock and lock after about 32 attempts, granting one more attempt for each ten minutes. Getting the bit-locker key from a discrete TPM v1.2 or v2.0 requires being a bus pirate [1]. Getting it from a "soft" TPM inside a CPU is likely much, much harder. [1] https://pulsesecurity.co.nz/articles/TPM-sniffing

TPM 2.0 allows communications over the bus to be encrypted specifically to prevent this attack, though Windows apparently does not actually use this feature[0]. Newer CPUs (since about 5 years ago) have the TPM embedded in the CPU. Intel calls this PTT and AMD calls it fTPM. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing

I wonder if there is a way to solve TPM sniffing attacks: https://pulsesecurity.co.nz/articles/TPM-sniffing https://news.ycombinator.com/item?id=19379092

I think if you have Bitlocker set up with a boot password, and you are careful to shut down when you're not using the computer, then you're probably fine. But in my experience most people use Bitlocker just with the Windows login prompt. As I understand it, the FPGA is able to initiate the TPM key extraction, yes. So it's not a sniffer that has to wait for the user to input the password. https://pulsesecurity.co.nz/articles/TPM-sniffing

Update. There were successful TPM attacks by sniffing data from LPC bus wires connecting TPM chip by HW logic analysers. The data is unecripted. "TPM2.0 devices support command and response parameter encryption, which would prevent the sniffing attacks. Windows doesn’t configure this though,". This prevents bare-metal in datacenter use case. https://pulsesecurity.co.nz/articles/TPM-sniffing