3 ms·

> I have to assume the traffic over the SPI bus is encrypted so the key can't just be dumped like that It's not. For some reason, Microsoft don't use TPM param

by bri3d 2y ago

> I have to assume the traffic over the SPI bus is encrypted so the key can't just be dumped like that It's not. For some reason, Microsoft don't use TPM parameter encryption, even though every year or two some security researcher or another comes up with another stunt TPM-sniffing device to parade around. > With LUKS it at least has a password prompt to unlock the drive. Configuration dependent. You can set up Linux to do the same thing as Windows here (I have my home video-security server set up this way, as it needs to reboot silently - I know that I'm vulnerable to warm/coldboot attack and software attack surface, but at least if someone yoinks the drive I'm safe), and Windows can also be configured to prompt for a password or use PIN-authenticated TPM sealed keys. > Fundamentally I don't understand BitLocker's security model. Minus the parameter encryption / bus-sniffing issue, it moves the boundary from "anyone can read your drive" to "someone needs to either perform a platform-level attack to access the contents of memory, or hack whatever services are running at the login screen to read your drive." It's a decent security improvement, actually, because it protects very well against stuff like "someone stole our financial data off of a random recycled hard drive."

raron 2y ago
> It's not. For some reason, Microsoft don't use TPM parameter encryption, even though every year or two some security researcher or another comes up with another stunt TPM-sniffing device to parade around. AFAIK it is useless, there is no way the TPM could authenticate the CPU. You could always desolder the TPM chip, send the correct data for updating PCRs and get the sealed key.
- bri3d 2y ago
  It's one of those "useless in theory but extremely meaningful in practicality" things, IMO. Getting the correct PCRs is going to be a whole lot harder than putting a sniffer on the LPC. It takes the attack from something that random TikTok security "influencers" sell devices for to something which requires meaningful effort.
  - raron 2y ago
    Using Bitlocker with a PIN solves that. Anyways on many modern system the TPM is often just part of the firmware running on a secure part of the CPU and probing the signals in the chip is probably outsider of the budget of TikTok influencers.
    - bri3d 2y ago
      > Using Bitlocker with a PIN solves that. At an enormous cost of having to remember and enter a PIN - not practical for corporate IT due to the propensity for forgetting and not practical for offline server use. > Anyways on many modern system the TPM is often just part of the firmware running on a secure part of the CPU On AMD this is almost 100% prevalent, yes. On Intel platforms a physical TPM is still common and PTT (firmware TPM) is usually disabled by default for some reason - a user/manager would usually have to re-select it in the BIOS. On desktop platforms I think PTT runs externally in the PCH, too, which is off-package and connected over DMI (I think on most mobile parts PCH is a separate on-package die). I don't think anyone has done research on how the fTPM part of PCH <-> CPU comms work on modern Intel platforms; this has always seemed like a fun topic for a deep dive and talk to me, but I've never had the time. I don't think either of these things excuses the lack of encrypted parameter support from BitLocker, though. I'd love to know why Microsoft continue not to use it. The only reason I've ever seen given is "it was deemed too complex / has an attack surface," which is an interesting idea but quite bunk when UEFI is already in the picture IMO.
      - p_ing 2y ago
        The Intel PCH is on-package exposed via [DMI] PCIe lane while AMD's fTPM is on-die. It would be unusual for any current device to have a discrete TPM, at least in the consumer space given current x86 processors have an fTPM.
      - wat10000 2y ago
        I haven’t used Windows since the XP days. Does Windows not have a login password? Or does something make it require a separate disk PIN and not just encrypt the drive with the login password? macOS does the latter and it seems like an obvious approach.
- tremon 2y ago
  That's the same kind of useless as "I don't have a front door. You could always drive through it with your car and get inside that way", right?
  - Dalewyn 2y ago
    Considering security "researchers" absolutely love to make cataclysmic mountains out of vulnerabilities that require local, physical access as the first step? Yes, it's the same kind of useless.
- p_ing 2y ago
  TPM is now in firmware and has been for quite a few years on Intel and AMD processors; Intel's on the PCH which is on-package and AMD's on-die. This isn't true for all implementations of TPM, but for AMD/Intel/Qualcomm where BitLocker is relevant, fTPM is used.
  - gquere 2y ago
    On company laptops this isn't always true, for instance here's the spec sheet of the ThinkPad T14 (this seems to be true for all ThinkPad models): https://www.lenovo.com/fr/fr/p/laptops/thinkpad/thinkpadt/thinkpad-t14-gen-4-(14-inch-intel)/21hdcto1wwfr2#tech_specs https://www.lenovo.com/fr/fr/p/laptops/thinkpad/thinkpadt/th... Where it states: Module dTPM 2.0 (Discrete Trusted Platform Module) Same for HP EliteBook and ProBooks: https://h20195.www2.hp.com/v2/GetPDF.aspx/c08049273.pdf https://h20195.www2.hp.com/v2/GetPDF.aspx/c08049273.pdf
- kryogen1c 2y ago
  > AFAIK it is useless "Useless" is grossly incorrect. Bitlocker is not invincible, but it lowers your threat surface by a huge %. In real terms: if i get your unbitlockered hard drive, i own your shit. It's not a hack you pay crypto for on the dark web, it's a trivial compromise that every person in IT has known for at least a decade. If you google it, you'll find it. Ring 0 access to all nonbitlockered windows installs. Takes like 2 minutes and a usb or cd. With bitlocker, at least every idiot on the planet can't login to your profile; that's not nothing
- mikepurvis 2y ago
  All modern CPUs now have it on-die, so doing a replay attack against desoldered TPMs is no longer a thing.
- 9cb14c1ec0 2y ago
  > You could always desolder the TPM chip, send the correct data for updating PCRs and get the sealed key. In modern CPUs, the TPM is built directly into the CPU, so you can't do this.

by bri3d 2y ago

raron 2y ago

> It's not. For some reason, Microsoft don't use TPM parameter encryption, even though every year or two some security researcher or another comes up with another stunt TPM-sniffing device to parade around. AFAIK it is useless, there is no way the TPM could authenticate the CPU. You could always desolder the TPM chip, send the correct data for updating PCRs and get the sealed key.

bri3d 2y ago
It's one of those "useless in theory but extremely meaningful in practicality" things, IMO. Getting the correct PCRs is going to be a whole lot harder than putting a sniffer on the LPC. It takes the attack from something that random TikTok security "influencers" sell devices for to something which requires meaningful effort.
- raron 2y ago
  Using Bitlocker with a PIN solves that. Anyways on many modern system the TPM is often just part of the firmware running on a secure part of the CPU and probing the signals in the chip is probably outsider of the budget of TikTok influencers.
  - bri3d 2y ago
    > Using Bitlocker with a PIN solves that. At an enormous cost of having to remember and enter a PIN - not practical for corporate IT due to the propensity for forgetting and not practical for offline server use. > Anyways on many modern system the TPM is often just part of the firmware running on a secure part of the CPU On AMD this is almost 100% prevalent, yes. On Intel platforms a physical TPM is still common and PTT (firmware TPM) is usually disabled by default for some reason - a user/manager would usually have to re-select it in the BIOS. On desktop platforms I think PTT runs externally in the PCH, too, which is off-package and connected over DMI (I think on most mobile parts PCH is a separate on-package die). I don't think anyone has done research on how the fTPM part of PCH <-> CPU comms work on modern Intel platforms; this has always seemed like a fun topic for a deep dive and talk to me, but I've never had the time. I don't think either of these things excuses the lack of encrypted parameter support from BitLocker, though. I'd love to know why Microsoft continue not to use it. The only reason I've ever seen given is "it was deemed too complex / has an attack surface," which is an interesting idea but quite bunk when UEFI is already in the picture IMO.
    - p_ing 2y ago
      The Intel PCH is on-package exposed via [DMI] PCIe lane while AMD's fTPM is on-die. It would be unusual for any current device to have a discrete TPM, at least in the consumer space given current x86 processors have an fTPM.
    - wat10000 2y ago
      I haven’t used Windows since the XP days. Does Windows not have a login password? Or does something make it require a separate disk PIN and not just encrypt the drive with the login password? macOS does the latter and it seems like an obvious approach.
tremon 2y ago
That's the same kind of useless as "I don't have a front door. You could always drive through it with your car and get inside that way", right?
- Dalewyn 2y ago
  Considering security "researchers" absolutely love to make cataclysmic mountains out of vulnerabilities that require local, physical access as the first step? Yes, it's the same kind of useless.
p_ing 2y ago
TPM is now in firmware and has been for quite a few years on Intel and AMD processors; Intel's on the PCH which is on-package and AMD's on-die. This isn't true for all implementations of TPM, but for AMD/Intel/Qualcomm where BitLocker is relevant, fTPM is used.
- gquere 2y ago
  On company laptops this isn't always true, for instance here's the spec sheet of the ThinkPad T14 (this seems to be true for all ThinkPad models): https://www.lenovo.com/fr/fr/p/laptops/thinkpad/thinkpadt/thinkpad-t14-gen-4-(14-inch-intel)/21hdcto1wwfr2#tech_specs https://www.lenovo.com/fr/fr/p/laptops/thinkpad/thinkpadt/th... Where it states: Module dTPM 2.0 (Discrete Trusted Platform Module) Same for HP EliteBook and ProBooks: https://h20195.www2.hp.com/v2/GetPDF.aspx/c08049273.pdf https://h20195.www2.hp.com/v2/GetPDF.aspx/c08049273.pdf
kryogen1c 2y ago
> AFAIK it is useless "Useless" is grossly incorrect. Bitlocker is not invincible, but it lowers your threat surface by a huge %. In real terms: if i get your unbitlockered hard drive, i own your shit. It's not a hack you pay crypto for on the dark web, it's a trivial compromise that every person in IT has known for at least a decade. If you google it, you'll find it. Ring 0 access to all nonbitlockered windows installs. Takes like 2 minutes and a usb or cd. With bitlocker, at least every idiot on the planet can't login to your profile; that's not nothing
mikepurvis 2y ago
All modern CPUs now have it on-die, so doing a replay attack against desoldered TPMs is no longer a thing.
9cb14c1ec0 2y ago
> You could always desolder the TPM chip, send the correct data for updating PCRs and get the sealed key. In modern CPUs, the TPM is built directly into the CPU, so you can't do this.