5 ms·

> If your attacker is both sophisticated and able to access your hardware directly, the game is over; nothing we can do can currently avoid this. I think with

> If your attacker is both sophisticated and able to access your hardware directly, the game is over; nothing we can do can currently avoid this. I think with blanket statements like this it's important to define sophisticated. For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? I'm of course not talking about social engineering or fooling the user into typing their password on a fake system, since this is preventable. * https://www.cs1.tf.fau.de/research/system-security-group/tresor-trevisor-armored/ https://www.cs1.tf.fau.de/research/system-security-group/tre...

hulitu 5y ago
> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? Intel ME and the equivalent AMD PSP. > I'm of course not talking about social engineering or fooling the user into typing their password on a fake system, since this is preventable. As other pointed out when the atacker has physical access it is game over. Also network access is insecure due to management engines.
- imwillofficial 5y ago
  Again, Blanket statements. What ME flaws?
  - eightails 5y ago
    There are dozens of known CSME vulns -- there's a list on cvedetails [0] which itself seems to be missing some (e.g. 2019-0090/2019-0091). Plenty of these could be used by a sophisticated attacker with physical access, and some can even be executed remotely. Here's an Intel Whitepaper detailing one such vulnerability of moderate severity (CVE-2019-0090, CVSS 4.4) [1]. From the 'Potential Consequences' table: > Unauthorized BIOS compromises OS loader and OS integrity... All use cases / user secrets protected by Intel TPM are compromised. Other bits and pieces of firmware including AMT have been similarly plagued with vulns [2], such as CVE-2017-5689, with a CVSS score of 10! These are often difficult to patch, and even more difficult to convince manufacturers to spend the effort testing and distributing updates for their products. My own laptop is still running a version of CSME vulnerable to many of these attacks. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-50730/Intel-Converged-Security-Management-Engine-Firmware.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/... [1] https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/cve-2019-0090-whitepaper.pdf https://www.intel.com/content/dam/www/public/us/en/security-... [2] https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-37542/Intel-Active-Management-Technology-Firmware.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/...
infogulch 5y ago
GP already made space for this analysis by admitting a sophisticated/unsophisticated axis, thus the contrary stance of your comment is unnecessary. You don't really make an argument on where your example should fall on that axis, which is what I would have preferred to see.
- kobalsky 5y ago
  I think it's a fair doubt. In this case, I don't know if sophistication could mean an evil maid attack with a breadboard and $15 worth of electronic components (which was required to break the tpm 1), or something better than what the FBI has since they struggled to unlock a terrorist's phone. I can worry about the former, and relax about the later. I'm not an expert and when someone throws that statement with authority I'd like to know if I'm vulnerable to geek or to the CIA
  - mnd999 5y ago
    It's certainly possible to MITM a TPM, this is why MS built all the keys into the CPU on the Xbox One[1]. [1] https://www.platformsecuritysummit.com/2019/speaker/chen/ https://www.platformsecuritysummit.com/2019/speaker/chen/
    - staticassertion 5y ago
      AFAIK that wouldn't be the case with TPM 2.0
belorn 5y ago
> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? There are two main vector of attacks to get access to the data. The simpler version are those that attempt to get they key by recording it when the user type it in, like hooking into the keyboard. No real need to try make it a fake system since no keyboard that I know of has security built in to prevent MITM attacks. If we are asking what spy agencies do, I would also suspect that the camera on a laptop could be replaced with a look-alike with a transmitter. The other main attack vector is to target the hardware while it is running and without waiting for the owner to type in the password. Get access to the main bus would be the primary target if the ram is not vulnerable (usb vulnerabilities, debug pins on the mother board, and so on). Vulnerabilities of the software is also an alternative, and if time is not a problem one could in theory wait until a vulnerability is found. I would assume that all internal connections are to a degree vulnerable to malicious designed hardware in mass consumer laptops, sever and desktops, but the main question is how to do it hot without crashing the machine.
temac 5y ago
> break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* On Windows (even modern versions IIRC) you can sniff the traffic (or maybe forge requests? I think it was simply sniffing though) to the TPM and get the keys to decrypt the HD, if there is no additional protection (like a PIN or password). Don't know if this is also applicable to Linux stacks. Kind of weird the interface has not been designed and/or programmed to resist to such attack, although of course password-less full disk decryption is often going to be less secure than with one, at least Macs are not subject to the same attack, I think?
- helpm33 5y ago
  FWIW, TPM 2.0 can encrypt the TPM traffic, so the attack by physically sniffing the TPM (https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...) is no longer possible.
  - temac 5y ago
    It can but from the article, with a not so old Windows stack it seems that this encryption is not used: > At the time of this writing BitLocker does not utilize any encrypted communication features of the TPM 2.0 standard, which means any data coming out of the TPM is coming out in plaintext, including the decryption key for Windows. If we can grab that key, we should be able to decrypt the drive, get access to the VPN client config, and maybe get access to the internal network.
a1369209993 5y ago
> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? a: 1 copy of all the computer hardware present in the target system. b: 1 secure radio link of sufficient bandwidth. c: 1 apartment or van near the target system. d: Sufficient equipment to interface with the target system (now in said apartment/van[c]) well enough to replicate its login UI (via radio link[b]) on the fake copy of it[a] you left in its place when you stole it.
fozzyfozfoz 5y ago
There are millions of lines of code in a bios supported by billions of transistors. A wireless component can fit inside any innocuous chip at any part. Software wise, the bios can contain many flaws that can be exposed via peripherals, remotely, etc. The certificates are kept secure by unknowns parties protected by algorithms that few can prove the validity of. A physical attack access is rarer (* from sophisticated attackers). Sophisticated/dominant attackers leverage low end attackers to do the actual physical attack. Identification and knowledge of such an attacker greatly diminishes that attacker's capability and credibility. Low end attackers are also resources. Remote attacks do exist. One of the common attack frameworks is a type of radar attack that exploit bugs in the hardware design. They work like RFID where some component has an exploit that can be activated remotely by radar. Defending against such attacks is quite difficult. Other attacks include errors in manufacturing. Not all chips come out of the oven equal, and a sophisticated attacker need not risk physical detection when they are capable of deducing the how to exploit those errors.

hulitu 5y ago

> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? Intel ME and the equivalent AMD PSP. > I'm of course not talking about social engineering or fooling the user into typing their password on a fake system, since this is preventable. As other pointed out when the atacker has physical access it is game over. Also network access is insecure due to management engines.

imwillofficial 5y ago
Again, Blanket statements. What ME flaws?
- eightails 5y ago
  There are dozens of known CSME vulns -- there's a list on cvedetails [0] which itself seems to be missing some (e.g. 2019-0090/2019-0091). Plenty of these could be used by a sophisticated attacker with physical access, and some can even be executed remotely. Here's an Intel Whitepaper detailing one such vulnerability of moderate severity (CVE-2019-0090, CVSS 4.4) [1]. From the 'Potential Consequences' table: > Unauthorized BIOS compromises OS loader and OS integrity... All use cases / user secrets protected by Intel TPM are compromised. Other bits and pieces of firmware including AMT have been similarly plagued with vulns [2], such as CVE-2017-5689, with a CVSS score of 10! These are often difficult to patch, and even more difficult to convince manufacturers to spend the effort testing and distributing updates for their products. My own laptop is still running a version of CSME vulnerable to many of these attacks. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-50730/Intel-Converged-Security-Management-Engine-Firmware.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/... [1] https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/cve-2019-0090-whitepaper.pdf https://www.intel.com/content/dam/www/public/us/en/security-... [2] https://www.cvedetails.com/vulnerability-list/vendor_id-238/product_id-37542/Intel-Active-Management-Technology-Firmware.html https://www.cvedetails.com/vulnerability-list/vendor_id-238/...

infogulch 5y ago

GP already made space for this analysis by admitting a sophisticated/unsophisticated axis, thus the contrary stance of your comment is unnecessary. You don't really make an argument on where your example should fall on that axis, which is what I would have preferred to see.

kobalsky 5y ago
I think it's a fair doubt. In this case, I don't know if sophistication could mean an evil maid attack with a breadboard and $15 worth of electronic components (which was required to break the tpm 1), or something better than what the FBI has since they struggled to unlock a terrorist's phone. I can worry about the former, and relax about the later. I'm not an expert and when someone throws that statement with authority I'd like to know if I'm vulnerable to geek or to the CIA
- mnd999 5y ago
  It's certainly possible to MITM a TPM, this is why MS built all the keys into the CPU on the Xbox One[1]. [1] https://www.platformsecuritysummit.com/2019/speaker/chen/ https://www.platformsecuritysummit.com/2019/speaker/chen/
  - staticassertion 5y ago
    AFAIK that wouldn't be the case with TPM 2.0

belorn 5y ago

> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? There are two main vector of attacks to get access to the data. The simpler version are those that attempt to get they key by recording it when the user type it in, like hooking into the keyboard. No real need to try make it a fake system since no keyboard that I know of has security built in to prevent MITM attacks. If we are asking what spy agencies do, I would also suspect that the camera on a laptop could be replaced with a look-alike with a transmitter. The other main attack vector is to target the hardware while it is running and without waiting for the owner to type in the password. Get access to the main bus would be the primary target if the ram is not vulnerable (usb vulnerabilities, debug pins on the mother board, and so on). Vulnerabilities of the software is also an alternative, and if time is not a problem one could in theory wait until a vulnerability is found. I would assume that all internal connections are to a degree vulnerable to malicious designed hardware in mass consumer laptops, sever and desktops, but the main question is how to do it hot without crashing the machine.

temac 5y ago

> break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* On Windows (even modern versions IIRC) you can sniff the traffic (or maybe forge requests? I think it was simply sniffing though) to the TPM and get the keys to decrypt the HD, if there is no additional protection (like a PIN or password). Don't know if this is also applicable to Linux stacks. Kind of weird the interface has not been designed and/or programmed to resist to such attack, although of course password-less full disk decryption is often going to be less secure than with one, at least Macs are not subject to the same attack, I think?

helpm33 5y ago
FWIW, TPM 2.0 can encrypt the TPM traffic, so the attack by physically sniffing the TPM (https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...) is no longer possible.
- temac 5y ago
  It can but from the article, with a not so old Windows stack it seems that this encryption is not used: > At the time of this writing BitLocker does not utilize any encrypted communication features of the TPM 2.0 standard, which means any data coming out of the TPM is coming out in plaintext, including the decryption key for Windows. If we can grab that key, we should be able to decrypt the drive, get access to the VPN client config, and maybe get access to the internal network.

a1369209993 5y ago

> For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? a: 1 copy of all the computer hardware present in the target system. b: 1 secure radio link of sufficient bandwidth. c: 1 apartment or van near the target system. d: Sufficient equipment to interface with the target system (now in said apartment/van[c]) well enough to replicate its login UI (via radio link[b]) on the fake copy of it[a] you left in its place when you stole it.

fozzyfozfoz 5y ago

There are millions of lines of code in a bios supported by billions of transistors. A wireless component can fit inside any innocuous chip at any part. Software wise, the bios can contain many flaws that can be exposed via peripherals, remotely, etc. The certificates are kept secure by unknowns parties protected by algorithms that few can prove the validity of. A physical attack access is rarer (* from sophisticated attackers). Sophisticated/dominant attackers leverage low end attackers to do the actual physical attack. Identification and knowledge of such an attacker greatly diminishes that attacker's capability and credibility. Low end attackers are also resources. Remote attacks do exist. One of the common attack frameworks is a type of radar attack that exploit bugs in the hardware design. They work like RFID where some component has an exploit that can be activated remotely by radar. Defending against such attacks is quite difficult. Other attacks include errors in manufacturing. Not all chips come out of the oven equal, and a sophisticated attacker need not risk physical detection when they are capable of deducing the how to exploit those errors.