4 ms·

It's never unsealed. `tpm2-totp` does an encrypted session to the TPM and runs `TPM2_HMAC` on the TPM shielded key, you can also include PCRs to add further aut

It's never unsealed. `tpm2-totp` does an encrypted session to the TPM and runs `TPM2_HMAC` on the TPM shielded key, you can also include PCRs to add further authentication to this entire exchange. What do you mean with "relay"? (All of this is trivially solved with glitter nail polish anyway.)

blueflow 2y ago
Yes and you can relay that authentication, too. The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. Making a machine visuals non-reproducible helps that, but only if the attacker cannot easily switch the exterior parts (chassis, keyboard) between the two machines.
- Foxboron 2y ago
  > The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. Also any authentication to generate that TOTP in the first place. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. This is a hollywood level threat scenario. It involves the attacker having intimate familiarity with the operating system, and having to break inn twice to even get this attack done. If you do put inn the effort then I deserve to be hacked and can pick up sheep farming in the country side.
  - blueflow 2y ago
    Why twice? You can keep the fake laptop. The OS does not matter? Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers.
    - Foxboron 2y ago
      > The OS does not matter? Of course it does. You are replaying the logos and screens. > Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers. You believe you can boot up an entire VNC client to display something that would take most machines under a second to display?
      - blueflow 2y ago
        > You are replaying the logos and screens Which the real machine happily gives me via HDMI/DisplayPort. > You believe you can boot up an entire VNC client to display something that would take most machines under a second to display? Do i need to? That the user presses the power button does not mean the machine will freshly boot. It could also be an unsuspend/wakeup or some regular ACPI event if the machine is only appearing to be off.
        Foxboron 2y ago
        > Do i need to? That the user presses the power button does not mean the machine will freshly boot. It could also be an unsuspend/wakeup or some regular ACPI event if the machine is only appearing to be off. This is a completely imaginary scenario. I'd be amazed to see it pulled off. EDIT: I hear Amazon is still getting pitches for Hacker 2. You might have a shot.
        blueflow 2y ago
        Windows Fastboot (active per default) is suspend disguised as shutdown: https://www.windowscentral.com/how-disable-windows-10-fast-startup https://www.windowscentral.com/how-disable-windows-10-fast-s...
        hedora 2y ago
        I'd like to add that the VNC relay machine only has to fool the end user once. So, the attacker wins as long as they think "the bios is a bit janky this morning, and this is more kernel panicky than usual", and type their pin/password anyway. Of course, it's much easier to just pop the original laptop open and interpose on the keyboard. Even easier: use acoustics to snoop the keystrokes. The snooper could even be 5g/wifi/gps, assuming it's easy to steal some power from the mainboard. I guess fingerprint + camera ID make that attack harder. Still, the hypothetical device could stream HDMI at a few FPS if it was easy to splice into the display panel cable. (I haven't cracked a laptop recently, but those used to be socketed + unencrypted.) Miniaturization is weird. The latter attack is probably easier to pull off these days than the former. If you wanted to swap my laptop, you'd need to replicate the dents and stickers. Good luck doing that!
  - tiberious726 2y ago
    There are like three operating systems in common use. An attacker being familiar with the one you use certainly isn't a "Hollywood level threat scenarios". Buying the same model laptop and swapping it with your targets is an elementary level targeted attack

blueflow 2y ago

Yes and you can relay that authentication, too. The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. Making a machine visuals non-reproducible helps that, but only if the attacker cannot easily switch the exterior parts (chassis, keyboard) between the two machines.

Foxboron 2y ago
> The same way the fake laptop can relay your password to me, i could also relay the generated TOTP code from the stolen laptop to the fake in front of you. Also any authentication to generate that TOTP in the first place. As tried to convey, the fake laptop is basically a full MITM on your screen/keyboard. This is a hollywood level threat scenario. It involves the attacker having intimate familiarity with the operating system, and having to break inn twice to even get this attack done. If you do put inn the effort then I deserve to be hacked and can pick up sheep farming in the country side.
- blueflow 2y ago
  Why twice? You can keep the fake laptop. The OS does not matter? Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers.
  - Foxboron 2y ago
    > The OS does not matter? Of course it does. You are replaying the logos and screens. > Grab the video output via HDMI/DisplayPort and insert the keypresses via USB. Thats likely gonna work. Basically what modern KVM switches do. And setup the fake laptop as VNC client. Same tech that companies can use to remotely manage servers. You believe you can boot up an entire VNC client to display something that would take most machines under a second to display?
    - blueflow 2y ago
      > You are replaying the logos and screens Which the real machine happily gives me via HDMI/DisplayPort. > You believe you can boot up an entire VNC client to display something that would take most machines under a second to display? Do i need to? That the user presses the power button does not mean the machine will freshly boot. It could also be an unsuspend/wakeup or some regular ACPI event if the machine is only appearing to be off.
      - Foxboron 2y ago
        > Do i need to? That the user presses the power button does not mean the machine will freshly boot. It could also be an unsuspend/wakeup or some regular ACPI event if the machine is only appearing to be off. This is a completely imaginary scenario. I'd be amazed to see it pulled off. EDIT: I hear Amazon is still getting pitches for Hacker 2. You might have a shot.
        blueflow 2y ago
        Windows Fastboot (active per default) is suspend disguised as shutdown: https://www.windowscentral.com/how-disable-windows-10-fast-startup https://www.windowscentral.com/how-disable-windows-10-fast-s...
        hedora 2y ago
        I'd like to add that the VNC relay machine only has to fool the end user once. So, the attacker wins as long as they think "the bios is a bit janky this morning, and this is more kernel panicky than usual", and type their pin/password anyway. Of course, it's much easier to just pop the original laptop open and interpose on the keyboard. Even easier: use acoustics to snoop the keystrokes. The snooper could even be 5g/wifi/gps, assuming it's easy to steal some power from the mainboard. I guess fingerprint + camera ID make that attack harder. Still, the hypothetical device could stream HDMI at a few FPS if it was easy to splice into the display panel cable. (I haven't cracked a laptop recently, but those used to be socketed + unencrypted.) Miniaturization is weird. The latter attack is probably easier to pull off these days than the former. If you wanted to swap my laptop, you'd need to replicate the dents and stickers. Good luck doing that!
- tiberious726 2y ago
  There are like three operating systems in common use. An attacker being familiar with the one you use certainly isn't a "Hollywood level threat scenarios". Buying the same model laptop and swapping it with your targets is an elementary level targeted attack