8 ms·
TPM Sniffing
- evancox100 5y agoBest mitigation against this isn't mentioned, which would be to use a built-in firmware TPM (fTPM). The fTPM may have other issues, but it would be a lot harder to probe the signals!
- xaduha 5y agoMS allows to use smartcards for Bitlocker, with a caveat that it can't be used for a system disk, only TPM can be used for that which seems arbitrary. If there's an option to use TPM+PIN, then there should be an option to use smartcard+PIN.
- pgeorgi 5y ago> only TPM can be used for that which seems arbitrary. Smartcard readers can use any number of protocols (e.g. random USB readers implementing custom handshakes) until you finally get to the smartcard while TPMs have a select few number of protocols until you're talking to the TPM. Arbitrary smartcard terminal drivers in your (secure) preboot software? maybe not.
- xaduha 5y agoMajority of modern readers are CCID compatible, limit it to that. libccid.so is 111KB, UsbccidDriver.dll is 81KB, I'm sure they would've managed if they wanted to. https://en.wikipedia.org/wiki/CCID_(protocol) https://en.wikipedia.org/wiki/CCID_(protocol)
- fomine3 5y agoSmartcard can't do self lockout at HW modification and other TPM features so not equivalent. Still, it should be able to use as additional key to password only BitLocker, but then maybe lack of Smartcard driver at UEFI is a blocker.
- xaduha 5y agoIt doesn't have to be an equivalent to be an option. Just like having no encryption is an option or auto-unlocking is an option. It's not like TPM detects that there are hardware changes, Windows itself does and it can lock it down. Or if there is some mechanism it doesn't seem to help in this case, so who is it stopping?
- pgeorgi 5y agoTPMs are notified about the system state along the boot process, so they can present the key only if the boot process looks like it's supposed to (and some of these attributes aren't even modifiable by the CPU but the side processor, e.g. Intel's "Management" Engine or AMD's "Security" Processor, so even taking over the x86 firmware doesn't help anymore) Smartcards lack that data (they wouldn't know that somebody attached a Thunderbolt device that pretends to be a GPU but also comes with its own option ROM that installed a backdoor), so they serve a different threat model.
- xaduha 5y agoAnd now the whole 'separate TPM' thing is obsolete, because newer processors will come with their own TPMs. This was a bad idea from the start if you ask me, with UEFI and shoving all sorts of things into it.
- Gys 5y ago> TL;DR: we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
- cryptonector 5y agoSee also the Dolos Group attack.
- gnabgib 5y agoThis isn't a trivial task (attaching probes to chip legs, or board connectors), and it's a good write-up, but sniffing seems like a poor word choice. This isn't picking up the data via covertly via existing attached components, or through some kind of software exploit - this is literally reading traveling messages which is nigh impossible to defend against aka "Reading data from the TPM" Short of a physically sealed path from the chip to all components that benefit from its knowledge (impossible on a desktop?), that can only be destructively accessed (triggering an alarm; like case-open switches) - I don't see how this can be defended against.
- opencl 5y agoTPM 2.0 allows communications over the bus to be encrypted specifically to prevent this attack, though Windows apparently does not actually use this feature[0]. Newer CPUs (since about 5 years ago) have the TPM embedded in the CPU. Intel calls this PTT and AMD calls it fTPM. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
- mjg59 5y agoThe main problem is that you don't have a strong way of establishing that you're talking to the real TPM. It does raise the bar from passive interception to hardware MITM, but it doesn't absolutely solve the problem
- brokenmachine 5y agoIt would if both the TPM and the chip talking to it use keys signed by the manufacturer. Then they could both verify the public signatures.
- cryptonector 5y agoA public key for a fixedTPM+fixedParent primary on the TPM could be stored "securely" (i.e., read-only) on the host side, and then you can do key exchange with the TPM using RSA key transport or ECDH. You can also use a shared secret, but storing a secret on the host side is even harder than storing a write-once (at factory), read-only PK.
- opwieurposiu 5y agoYou can buy very small test clips for hooking on to TSSOP pins. They are kind of expensive and quite delicate, but come in handy if you do not want to solder on tiny wires. https://www.ebay.com/itm/182107308498 https://www.ebay.com/itm/182107308498
- voxadam 5y agoIf you want expensive check out what Pomona has to offer. https://www.digikey.com/en/products/detail/pomona-electronics/6442/737723 https://www.digikey.com/en/products/detail/pomona-electronic...
- rasz 5y agoI smelled trouble the second I read "low transmission speed" and "25Mhz" in same sentence :) At that point picture of 30cm leads was a given. “I mean it’s low speed interface, Michael. How fast could it go? 25MHz?”
- nielsbot 5y agoThey did say there were lots of errors in capture, but they got around it by capturing multiple times and figuring out which bits were captured incorrectly.
- rasz 5y agoInstead of realizing 25MHz is awfully close to CB radio or RC cars, things what worked great with antennas around the length of my probe leads. :)
- artificialLimbs 5y agoYou should be careful about running software on your production domain controller. Great write up.
- dogmatism 5y agopretty sure that was a joke. There was some dry humour sprinkled in throughout
- ohazi 5y agoDoes anyone make a "glass house" TPM? As in, a device that you can plug in to your motherboard's TPM port that implements the complete TPM 2.0 protocol, that looks/acts/feels like a real TPM, but then deliberately includes a side-channel like a USB port or something that gives a user full access to the TPM internals (keys, registers, etc.). Obviously you'd never use something like this for trusted boot, but with Windows 11 requiring a TPM, and applications moving in the direction of "we refuse to run unless the environment is pristine" (e.g. video games with anti-cheat features, banking apps), it seems that something like this might eventually be useful for getting around DRM and restoring our ability to run whatever we want on machines that we own.
- deleted 5y ago[deleted]
- userbinator 5y agoI think emulators have virtual TPMs which you can definitely inspect and manipulate the internal state of, and the specs are freely available so presumably anyone with some microcontroller/embedded experience can make one. The problem is that software is able to determine whether that TPM is an "approved" one, and that process being cryptographic, is going to be pretty hard to get past: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Endorsement_keys https://en.wikipedia.org/wiki/Trusted_Platform_Module#Endors... Ever since the beginning I have maintained the strong and unchanging opinion that everything TPM and "trusted computing" related is ultimately user-hostile and a threat to freedom, and it's disturbing to see that the worst nightmares are slowing becoming reality. It used to be drugs and terrorism. Now it's "security".
- endianswap 5y agoYes, see libtpms for the most prominent software TPM implementation for emulators: https://github.com/stefanberger/libtpms https://github.com/stefanberger/libtpms
- ohazi 5y agoWow, I didn't realize they still relied on a golden-key style root of trust... I assumed they were trust on first use. That seems pretty bad!
- sennight 5y agoThese schematic shops... don't give them money. It would be different if they added any value at all, but I've seen no evidence of that - just a moneygrab. Here is what you do: use a DHT search engine to get the same thing. That is probably how they got it in the first place. A query of "ThinkPad L440" on btdig yields the schematics and denies the scammers $20 - further denying funds to the DDoS SaaS or botnet rental they'd eventually have spend it on.
- userbinator 5y agoEasy way to find laptop schematics is by OEM name. In this case, Wistron LOS-1. It's sad that these "researchers" couldn't find it for free.[1] further denying funds to the DDoS SaaS or botnet rental they'd eventually have spend it on. That is unfounded fearmongering. I suspect at least some of the funds go to paying neighbourly employees working at said OEMs so they'll share more schematics. Most if not all the schematics you see available are leaks, after all. [1] Maybe if they do come across companies leaking them, they'll be do-gooding and closing those "holes" (and effectively fighting against right-to-repair), so perhaps it's better that they didn't.
- sennight 5y ago> Easy way to find laptop schematics is by OEM name. In this case, Wistron LOS-1. That is easier... now you just need to magically know the OEM name of the board! > That is unfounded fearmongering. No, it is pretty solidly founded in logic: these operations have nearly zero operating expenses - profit is a function of visibility. What other scumbag activities shares that same model? You think some of the viagra spam proceeds are getting reinvested into medical research as well? These sites always lag availability elsewhere - they aren't the source for anything.
- JudasGoat 5y agoHow did you learn that Wistron LOS-1 is the name for L 440?
- userbinator 5y ago
- cryptonector 5y agoThere's a number of issues with discrete TPMs and physical security. Before I describe them, there is good news: some CPUs can run a firmware TPM in an ME or a secure enclave, and using it does not involve a bus on a motherboard that could be hacked into. The problems with discrete TPMs: - the BMC and BIOS don't use encrypted sessions -- their communications with the TPM can be snooped (read: bitlocker keys can be stolen) and tampered with (read: malware can be excluded from PCR measurements with the help of a physical attacker) - to authenticate the TPM when using encrypted sessions the BMC and BIOS would need to be able to store a public key for the TPM somewhere that isn't easy for malware to tamper with -- this means that even with encryption there would be a TPM impersonation / MITM attack - even using encrypted sessions, if the attacker can force the TPM to reset without also resetting the CPU, then the attacker can make the PCRs match golden state (i.e., without the malware measured into the PCRs) The first point is easy enough to address -- it's just a matter of code. The second point is very difficult to address. The third point would probably require changes to the CPU and additional design and standardization. It's just very difficult to strongly bind the TPM's resetCount to the CPU's state to ensure that both always reset together. The only current solution to all three problems is to use firmware TPMs (fTPMs) where available. Of course, for things like servers in secure racks in secure data centers, this is all really not a problem. But for laptops, it is. If an fTPM is not available, there's always the possibility of adding physical protection to the bus (burying it deeper in the PCB, using resin, etc.).
- zimmerfrei 5y agoYou can authenticate to a TPM via HMAC and a shared secret key, so also the two other points can be addressed with code. The catch is that the other elements need to be able to store the secret, and they need to "pair" to the TPM when the motherboard is assembled. Also, scenarios concerning the legitimate replacement of the CPU need to be addressed. Those are all key management tasks that manufacturers are not good at in general... so here we are with unauthenticated sessions...
- cryptonector 5y ago> You can authenticate to a TPM via HMAC and a shared secret key, ... > The catch is that the other elements need to be able to store the secret... Yes, that catch is the problem. You can also authenticate the TPM to the host w/o authenticating the host to the TPM -- all you need is to be able to record the public key of a suitable primary (say, the EK) on the TPM that has fixedTPM and fixedParent set. Less messy than having to store a secret on the host, but not really enough to solve the reset issue.
- brokenmachine 5y ago>the space between each pin is only 0.65 millimeters (for our metrically impaired readers, this is 0.4 millionths of a mile). Lol, hilarious.
- jeffrallen 5y ago> Now, if (1) you have the correct equipment and (2) you’re confident in your micro-soldering skills, you can solder wires directly on these pins to attach the probes, but the space between each pin is only 0.65 millimeters (for our metrically impaired readers, this is 0.4 millionths of a mile). We did not meet several of these two requirements. LOL.
- intricatedetail 5y agoIf TPM chips are not documented down to a die level and implementation is not verifiable then how can anyone trust them? If I created a honey pot device I'd also call it Trusted Platform Module. Isn't the whole point of this project to ensure three letter agencies can extract keys and decrypt any device that comes their way?
- brokenmachine 5y agoOf course. It's all security theater at best/Microsoft bigcorp DRM at worst. It does mean that your average attacker won't be able to decrypt your laptop, but you could have easily done that without a TPM.
- DimiTom 5y agoLPC is not a secure bus. TPM on LPC bus without Parameter Encryption enabled is not protected against Man-in-the-middle attacks. I recommend SafeBoot and TPM.dev for more information.