4 ms·

Trusted platform module security defeated in 30 minutes, no soldering required

EvanAnderson 5y ago
Previous discussion: https://news.ycombinator.com/item?id=27986316 https://news.ycombinator.com/item?id=27986316 TL;DR - The laptop owner didn't use a PIN on the TPM or a secondary credential. The full disk encryption key was read off a SPI bus from the TPM.
- cmurf 5y ago
  I've got a Windows 10 system that uses TPM to seal a bitlocker key, out of the box. And nothing asks for a PIN prior to the login window coming up. Having to be prompted for a PIN to do something as simple as a reboot, isn't a great UX. And also has UI complexities in the pre-boot environment. So? It seems to me this is a big problem for the default out of the box user experience. Edit: Ok after searching the article I can't tell how/where they sealed the key. Bitlocker tells the TPM to measure some things and if that measurement matches was in PCR12 (or whatever is defined) then reveal a secret. That secret is the bitlocker key.
  - EvanAnderson 5y ago
    Needing a PIN or password to boot is a tradeoff. If it's warranted by your threat model you take that tradeoff. (Personally I'd love to see the encryption and key storage module being a physically separable device that I could carry with me. Something like an HSM with I/O bandwidth sufficient to perform the bulk encryption on the device itself.)
- nuker 5y ago
  TPM can work without PIN requirement imho. It makes environment measurements to decide that nothing has changed. Secure boot had to be enabled too to assert that bootloader is signed.
sparker72678 5y ago
> The researchers connected a Saleae logic analyzer to the CMOS. In short order, they were able to extract every byte moving through the chip. The researchers then used the bitlocker-spi-toolkit written by Henri Numi to isolate the key inside the mass of data. Clever, and certainly feels like a design flaw that should be addressed. But also not something most people are going to be able to pull off. If you have physical access to the computer, it's always going to be game over. And, if you don't, social engineering always works if you try hard enough.
- gruez 5y ago
  >Clever, and certainly feels like a design flaw that should be addressed. Solution: use fTPM (integrated into the CPU)
- bobcostas55 5y ago
  If it doesn't protect against physical access what's the point of TPM?
  - smitty1110 5y ago
    CYA, so you can blame someone else for breaches or stolen material. It's really for enterprise IT departments, not end users.
  - causi 5y ago
    Security theater in order to generate headlines and sales.
  - toast0 5y ago
    Sounds like it's a convenient place to store the key that's not on the disk. When it's time to retire the machine, wiping the TPM or just disposing of the TPM separately from the disk renders the data on the disk unreadable even if it doesn't get wiped.
  - jnwatson 5y ago
    It does if you use it correctly.
upofadown 5y ago
The TPM was being used just as a straight up storage device. It wasn't actually protecting anything. An EEPROM/flash device would work just as well. In particular there was no protection of the key used for whole disk encryption. Why did no one get suspicious when they noticed that they were not even being asked for a PIN?
nuker 5y ago
> Microsoft’s BitLocker, meanwhile, doesn’t use any of the encrypted communications features of the latest TPM standard. Disk encryption key was in cleartext on the SPI bus

Previous discussion: https://news.ycombinator.com/item?id=27986316 https://news.ycombinator.com/item?id=27986316 TL;DR - The laptop owner didn't use a PIN on the TPM or a secondary credential. The full disk encryption key was read off a SPI bus from the TPM.

cmurf 5y ago
I've got a Windows 10 system that uses TPM to seal a bitlocker key, out of the box. And nothing asks for a PIN prior to the login window coming up. Having to be prompted for a PIN to do something as simple as a reboot, isn't a great UX. And also has UI complexities in the pre-boot environment. So? It seems to me this is a big problem for the default out of the box user experience. Edit: Ok after searching the article I can't tell how/where they sealed the key. Bitlocker tells the TPM to measure some things and if that measurement matches was in PCR12 (or whatever is defined) then reveal a secret. That secret is the bitlocker key.
- EvanAnderson 5y ago
  Needing a PIN or password to boot is a tradeoff. If it's warranted by your threat model you take that tradeoff. (Personally I'd love to see the encryption and key storage module being a physically separable device that I could carry with me. Something like an HSM with I/O bandwidth sufficient to perform the bulk encryption on the device itself.)
nuker 5y ago
TPM can work without PIN requirement imho. It makes environment measurements to decide that nothing has changed. Secure boot had to be enabled too to assert that bootloader is signed.

sparker72678 5y ago

> The researchers connected a Saleae logic analyzer to the CMOS. In short order, they were able to extract every byte moving through the chip. The researchers then used the bitlocker-spi-toolkit written by Henri Numi to isolate the key inside the mass of data. Clever, and certainly feels like a design flaw that should be addressed. But also not something most people are going to be able to pull off. If you have physical access to the computer, it's always going to be game over. And, if you don't, social engineering always works if you try hard enough.

gruez 5y ago
>Clever, and certainly feels like a design flaw that should be addressed. Solution: use fTPM (integrated into the CPU)
bobcostas55 5y ago
If it doesn't protect against physical access what's the point of TPM?
- smitty1110 5y ago
  CYA, so you can blame someone else for breaches or stolen material. It's really for enterprise IT departments, not end users.
- causi 5y ago
  Security theater in order to generate headlines and sales.
- toast0 5y ago
  Sounds like it's a convenient place to store the key that's not on the disk. When it's time to retire the machine, wiping the TPM or just disposing of the TPM separately from the disk renders the data on the disk unreadable even if it doesn't get wiped.
- jnwatson 5y ago
  It does if you use it correctly.

upofadown 5y ago

The TPM was being used just as a straight up storage device. It wasn't actually protecting anything. An EEPROM/flash device would work just as well. In particular there was no protection of the key used for whole disk encryption. Why did no one get suspicious when they noticed that they were not even being asked for a PIN?

nuker 5y ago

> Microsoft’s BitLocker, meanwhile, doesn’t use any of the encrypted communications features of the latest TPM standard. Disk encryption key was in cleartext on the SPI bus