4 ms·

I'd buy you an replacement laptop of the same model and then install a rendering of your boot process and password prompt on it. Doing a switcheroo and waiting

I'd buy you an replacement laptop of the same model and then install a rendering of your boot process and password prompt on it. Doing a switcheroo and waiting in my bunker until the fake sends me the password you entered. The screen/keyboard is not authenticated to the user, and TPM is not capable of fixing that. It doesn't require some state actor to do that. Just money.

Foxboron 2y ago
`tpm2-totp` defeats the entire "replace the laptop" threat scenario. https://github.com/tpm2-software/tpm2-totp https://github.com/tpm2-software/tpm2-totp
- blueflow 2y ago
  The "replaced laptop" scenario is a full MITM on the hardware. TOTP generally does not protect against MITM. The required TOTP code is, in this scenario, generated by the device in the attackers hand. So the fake could also display it.
  - Foxboron 2y ago
    You need to decide between the attack here. Are you subverting hardware or are you replacing a laptop? The TOTP token here is sealed inside TPM.
    - blueflow 2y ago
      And what do you need to do to unseal it? And why cant the fake laptop relay that to the real laptop?
      - Foxboron 2y ago
        It's never unsealed. `tpm2-totp` does an encrypted session to the TPM and runs `TPM2_HMAC` on the TPM shielded key, you can also include PCRs to add further authentication to this entire exchange. What do you mean with "relay"? (All of this is trivially solved with glitter nail polish anyway.)
        blueflow 2y ago
        Yes and you can relay that authentication, too. The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. Making a machine visuals non-reproducible helps that, but only if the attacker cannot easily switch the exterior parts (chassis, keyboard) between the two machines.
        Foxboron 2y ago
        > The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. Also any authentication to generate that TOTP in the first place. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. This is a hollywood level threat scenario. It involves the attacker having intimate familiarity with the operating system, and having to break inn twice to even get this attack done. If you do put inn the effort then I deserve to be hacked and can pick up sheep farming in the country side.
        blueflow 2y ago
        Why twice? You can keep the fake laptop. The OS does not matter? Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers.
        Foxboron 2y ago
        > The OS does not matter? Of course it does. You are replaying the logos and screens. > Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers. You believe you can boot up an entire VNC client to display something that would take most machines under a second to display?
p_l 2y ago
Attestation closes this vulnerability, for example through tools like Ultrablue [1] which provides a self-hosted method of verifying that the TCB has not been modified through external tool (in this case, your phone running Ultrablue) [1] https://github.com/ANSSI-FR/ultrablue https://github.com/ANSSI-FR/ultrablue
- blueflow 2y ago
  The TCB has not been modified - that's the point of that attack. Its just physically elsewhere. A high 24 dBi high gain antennae to close that gap costs 70 EUR and you would attest the device in the attackers hands, not the one in front of you.
  - hedora 2y ago
    I think some of those hardware attestation thingies use clocks and tight latency jitter bounds to make replay attacks harder. If it takes more than "2 x time light takes to move 10 ft + deterministic delay from the other side", or less than the deterministic delay, then they refuse to unlock. Some cars even get this right these days. Most don't.
dist-epoch 2y ago
A solution would be to have two passwords, and display a secret security image between them. User is required to not enter the second password if the wrong security image is displayed. You can still attack it with a fancy radio transmitter which transmits the security image from the stolen laptop when it's displayed after you've entered the first password to the second laptop.
fargle 2y ago
i like the way you think

Foxboron 2y ago

`tpm2-totp` defeats the entire "replace the laptop" threat scenario. https://github.com/tpm2-software/tpm2-totp https://github.com/tpm2-software/tpm2-totp

blueflow 2y ago
The "replaced laptop" scenario is a full MITM on the hardware. TOTP generally does not protect against MITM. The required TOTP code is, in this scenario, generated by the device in the attackers hand. So the fake could also display it.
- Foxboron 2y ago
  You need to decide between the attack here. Are you subverting hardware or are you replacing a laptop? The TOTP token here is sealed inside TPM.
  - blueflow 2y ago
    And what do you need to do to unseal it? And why cant the fake laptop relay that to the real laptop?
    - Foxboron 2y ago
      It's never unsealed. `tpm2-totp` does an encrypted session to the TPM and runs `TPM2_HMAC` on the TPM shielded key, you can also include PCRs to add further authentication to this entire exchange. What do you mean with "relay"? (All of this is trivially solved with glitter nail polish anyway.)
      - blueflow 2y ago
        Yes and you can relay that authentication, too. The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. Making a machine visuals non-reproducible helps that, but only if the attacker cannot easily switch the exterior parts (chassis, keyboard) between the two machines.
        Foxboron 2y ago
        > The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. Also any authentication to generate that TOTP in the first place. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. This is a hollywood level threat scenario. It involves the attacker having intimate familiarity with the operating system, and having to break inn twice to even get this attack done. If you do put inn the effort then I deserve to be hacked and can pick up sheep farming in the country side.
        blueflow 2y ago
        Why twice? You can keep the fake laptop. The OS does not matter? Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers.
        Foxboron 2y ago
        > The OS does not matter? Of course it does. You are replaying the logos and screens. > Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers. You believe you can boot up an entire VNC client to display something that would take most machines under a second to display?

p_l 2y ago

Attestation closes this vulnerability, for example through tools like Ultrablue [1] which provides a self-hosted method of verifying that the TCB has not been modified through external tool (in this case, your phone running Ultrablue) [1] https://github.com/ANSSI-FR/ultrablue https://github.com/ANSSI-FR/ultrablue

blueflow 2y ago
The TCB has not been modified - that's the point of that attack. Its just physically elsewhere. A high 24 dBi high gain antennae to close that gap costs 70 EUR and you would attest the device in the attackers hands, not the one in front of you.
- hedora 2y ago
  I think some of those hardware attestation thingies use clocks and tight latency jitter bounds to make replay attacks harder. If it takes more than "2 x time light takes to move 10 ft + deterministic delay from the other side", or less than the deterministic delay, then they refuse to unlock. Some cars even get this right these days. Most don't.

dist-epoch 2y ago

A solution would be to have two passwords, and display a secret security image between them. User is required to not enter the second password if the wrong security image is displayed. You can still attack it with a fancy radio transmitter which transmits the security image from the stolen laptop when it's displayed after you've entered the first password to the second laptop.

fargle 2y ago

i like the way you think