5 ms·

The title makes it sound like Bitlocker's encryption is what was being broken, but what is broken is the key exchange on some laptops. The same vulnerability al

The title makes it sound like Bitlocker's encryption is what was being broken, but what is broken is the key exchange on some laptops. The same vulnerability also affects LUKS2 and any other transparently encrypted system using a dedicated TPM chip for encryption. Developing the exploit itself also took significantly more than $10, it's not like you can just hook up a Raspberry Pi to any circuit board and start bit banging blindly. Without a scope that supports digital signal processing, you'll struggle to adapt this attack to TPMs that speak a different protocol. It's a shame that there's no E2EE between the CPU and the TPM, but luckily on many modern devices with fTPMs this attack doesn't apply. Unlocking your disk with systemd-boot will still be relatively safe. On affected systems, the workaround (a TPM PIN) still leaves for a much more secure encryption system than a plain password would, assuming you have stored your backup key somewhere safe.

samrus 3y ago
Your point about a TPM PIN being more secure than a password doesn't make sense. Both are passwords. If you're assuming the user stored their PIN safely, then you can also assume they would store their password safely. Your broader point is fair though. Because this explout is nullified by a built-in TPM (already here) or the lanes being end to end encrypted (ship has sailed)
- lozenge 3y ago
  I think they mean a Windows password. You enter it after the disk is already decrypted.
- dist-epoch 3y ago
  Security in depth. TPM+PIN prevents taking/imaging the drive and trying an offline attack. And TPM is rate-limited, another security in depth feature.
- jeroenhd 3y ago
  One is a password, the other is an unlock phrase for a securely generated key. Password based keys need to go through PKDFs and have limited entropy. A "PIN" in the TPM sense is alphanumeric and will be entered the same way the user enters a passphrase, except the secret that actually protects the disk isn't derived from that passphrase. It's much harder to brute force a TPM PIN than it is to brute force your average PKDF function. The brute force complexity grows to encompass the full key space rather than the key space of a key derived from memorable alphanumeric text. With a proper passphrase this probably won't matter much in terms of feasibility, but a lot of users pick terrible passwords that are easy to brute force with a whole bunch of servers, while with a TPM chip an attacker would need to choose another method (i.e. attacking the TPM itself).
mschuster91 3y ago
> Without a scope that supports digital signal processing, you'll struggle to adapt this attack to TPMs that speak a different protocol. It's like with console modchips - once someone has developed an attack, every highschooler with a soldering iron and moderate skills can do it.
puzzlingcaptcha 3y ago
Don't all TPUs use the same protocol? In any case, a basic sigrok-supported logic analyzer is only another $10.
- g_p 3y ago
  Yes, and yes - the LPC bus is standardized, and TPMs need to use the same protocol to enable them to be modules on the motherboard. And yes, it's only $10 or thereabouts for a logic analyzer that can decode LPC bus communications. 2019 ref - https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
- michaelt 3y ago
  Some processors have a 'Firmware TPM' or 'Platform Trust Technology' where the TPM is integrated into the CPU itself, meaning no wires to probe/interpose. RAM, PCIe and USB remain unencrypted though so you can just interpose one of those if you're performing an evil maid attack.
  - dist-epoch 3y ago
    Recent Intel/AMD CPUs feature transparent full memory encryption. Recent AMDs have another feature called SecureBio(metrics) which directly connect one USB socket to the CPU in such a way interception is not possible, which allows one to design a secure USB device (fingerprint reader, webcam for now) which can't be intercepted at the bus level. PCIe is still vulnerable, but I bet it won't be long before transparent encryption comes to it.
- jeroenhd 3y ago
  Many of them use LPC, but LPC isn't the only protocol used, as I found out in my attempts to find a TPM for my desktop.
rasz 3y ago
You dont need expensive scopes (digital signal processing? you mean fancy decoders?). All you need is LPC development board. LPC is just serial ISA bus. >Developing the exploit itself also took significantly more than $10 Less. You can perform same attack using $6.44 Free International Shipping "EZ-USB FX2LP CY7C68013A USB2.0 Core Boards Logic Analyzer" ebay board and https://sigrok.org/wiki/Protocol_decoder:Lpc https://sigrok.org/wiki/Protocol_decoder:Lpc
ThePowerOfFuet 3y ago
>The title makes it sound like Bitlocker's encryption is what was being broken, but what is broken is the key exchange on some laptops. If the KEX is broken, the encryption is broken.
- close04 3y ago
  I think OP’s point is that singling out BitLocker when the attack is not specific to it is misleading. It leaves the wrong impression that other methods relying on the same key exchange mechanism are safe. Name dropping BitLocker was one sure way to gather attention for something that had been proven years ago, and had already reached a “close enough for all intents and purposes” price point [0]. Not unlike name dropping Tesla or Apple even for mundane things. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
mjg59 3y ago
There is E2EE! The spec defines it! It works! But Bitlocker doesn't use it (systemd-cryptenroll does), and as a result is vulnerable to this attack.
- jeroenhd 3y ago
  As far as I understand parameter encryption, there are still ways to compromise the key if you don't use the TPM PIN, because of the difficulties of establishing trust between the TPM and the CPU and the risk of a MitM attack. This makes it much more difficult to attack the TPM, but the underlying challenge remains. I'm happy that systemd-cryptenroll does what Windows failed to do, though. I can't fathom why Microsoft would make it do easy for an attacker to bypass Bitlocker's encryption like this.

samrus 3y ago

Your point about a TPM PIN being more secure than a password doesn't make sense. Both are passwords. If you're assuming the user stored their PIN safely, then you can also assume they would store their password safely. Your broader point is fair though. Because this explout is nullified by a built-in TPM (already here) or the lanes being end to end encrypted (ship has sailed)

lozenge 3y ago
I think they mean a Windows password. You enter it after the disk is already decrypted.
dist-epoch 3y ago
Security in depth. TPM+PIN prevents taking/imaging the drive and trying an offline attack. And TPM is rate-limited, another security in depth feature.
jeroenhd 3y ago
One is a password, the other is an unlock phrase for a securely generated key. Password based keys need to go through PKDFs and have limited entropy. A "PIN" in the TPM sense is alphanumeric and will be entered the same way the user enters a passphrase, except the secret that actually protects the disk isn't derived from that passphrase. It's much harder to brute force a TPM PIN than it is to brute force your average PKDF function. The brute force complexity grows to encompass the full key space rather than the key space of a key derived from memorable alphanumeric text. With a proper passphrase this probably won't matter much in terms of feasibility, but a lot of users pick terrible passwords that are easy to brute force with a whole bunch of servers, while with a TPM chip an attacker would need to choose another method (i.e. attacking the TPM itself).

mschuster91 3y ago

> Without a scope that supports digital signal processing, you'll struggle to adapt this attack to TPMs that speak a different protocol. It's like with console modchips - once someone has developed an attack, every highschooler with a soldering iron and moderate skills can do it.

puzzlingcaptcha 3y ago

Don't all TPUs use the same protocol? In any case, a basic sigrok-supported logic analyzer is only another $10.

g_p 3y ago
Yes, and yes - the LPC bus is standardized, and TPMs need to use the same protocol to enable them to be modules on the motherboard. And yes, it's only $10 or thereabouts for a logic analyzer that can decode LPC bus communications. 2019 ref - https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
michaelt 3y ago
Some processors have a 'Firmware TPM' or 'Platform Trust Technology' where the TPM is integrated into the CPU itself, meaning no wires to probe/interpose. RAM, PCIe and USB remain unencrypted though so you can just interpose one of those if you're performing an evil maid attack.
- dist-epoch 3y ago
  Recent Intel/AMD CPUs feature transparent full memory encryption. Recent AMDs have another feature called SecureBio(metrics) which directly connect one USB socket to the CPU in such a way interception is not possible, which allows one to design a secure USB device (fingerprint reader, webcam for now) which can't be intercepted at the bus level. PCIe is still vulnerable, but I bet it won't be long before transparent encryption comes to it.
jeroenhd 3y ago
Many of them use LPC, but LPC isn't the only protocol used, as I found out in my attempts to find a TPM for my desktop.

rasz 3y ago

You dont need expensive scopes (digital signal processing? you mean fancy decoders?). All you need is LPC development board. LPC is just serial ISA bus. >Developing the exploit itself also took significantly more than $10 Less. You can perform same attack using $6.44 Free International Shipping "EZ-USB FX2LP CY7C68013A USB2.0 Core Boards Logic Analyzer" ebay board and https://sigrok.org/wiki/Protocol_decoder:Lpc https://sigrok.org/wiki/Protocol_decoder:Lpc

ThePowerOfFuet 3y ago

>The title makes it sound like Bitlocker's encryption is what was being broken, but what is broken is the key exchange on some laptops. If the KEX is broken, the encryption is broken.

close04 3y ago
I think OP’s point is that singling out BitLocker when the attack is not specific to it is misleading. It leaves the wrong impression that other methods relying on the same key exchange mechanism are safe. Name dropping BitLocker was one sure way to gather attention for something that had been proven years ago, and had already reached a “close enough for all intents and purposes” price point [0]. Not unlike name dropping Tesla or Apple even for mundane things. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing

mjg59 3y ago

There is E2EE! The spec defines it! It works! But Bitlocker doesn't use it (systemd-cryptenroll does), and as a result is vulnerable to this attack.

jeroenhd 3y ago
As far as I understand parameter encryption, there are still ways to compromise the key if you don't use the TPM PIN, because of the difficulties of establishing trust between the TPM and the CPU and the risk of a MitM attack. This makes it much more difficult to attack the TPM, but the underlying challenge remains. I'm happy that systemd-cryptenroll does what Windows failed to do, though. I can't fathom why Microsoft would make it do easy for an attacker to bypass Bitlocker's encryption like this.