4 ms·
If your threat model involves people sniffing TPM signals in transit, you’re in a different league to me. In most cases I assume physical security (security gua
by hsbauauvhabzb 3y ago
If your threat model involves people sniffing TPM signals in transit, you’re in a different league to me. In most cases I assume physical security (security guards, epoxy the motherboard, etc) become the mitigating factors. I’m just trying to avoid evil maids.
- loup-vaillant 3y agoMaking an TPM genie isn’t that hard, and once we have that the Evil Maid can fairly easily unplug the discrete TPM, plug the Genie, and plug the TPM into the genie. And voilà, you can now sniff TPM signals in transit. Only works with discrete TPMs of course, but Man-in-the-Middle is not out of this world. https://github.com/nccgroup/TPMGenie https://github.com/nccgroup/TPMGenie
- hsbauauvhabzb 3y agoI’m more referring to laptops. If you’re using a desktop, you also have other issues (like key injectors unless you inspect the cable going from your pc to your desk every time, etc).