3 ms·

Stupid question: was there no responsible disclosure and is there no cve assigned? Seems like a rather practical attack (or am I missing something? Do the res

by riedel 3y ago

Stupid question: was there no responsible disclosure and is there no cve assigned? Seems like a rather practical attack (or am I missing something? Do the researchers consider it a known fact that that fTPM is broken by design and thus do think that nobody will get hurt? It would make sense to require an additional passphrase on fTPM devices for bitlocker. Was there a statement from Microsoft or AMD?

hnj2 3y ago
From the paper: "All security-relevant findings discussed in this paper were responsibly disclosed to AMD, Microsoft, and the systemd-cryptenroll maintainers. The systemd-cryptenroll maintainers quickly got back to us to discuss specific mitigation strategies."
- deleted 3y ago
  [deleted]
- riedel 3y ago
  Thx. I overlooked this part. So AMD and Microsoft simply ignored it and leave customers unprotected. Wow.