Pulse Security's blog covers penetration testing research, including TPM and BitLocker attacks, TOTP brute forcing, and vulnerabilities in tools like ZeroTier.
Commenters cite its TPM sniffing article to show that TPM-based disk encryption can be bypassed with physical access, and discuss mitigations.
TPM, at least older version <1.2 were still subject to physical key exfil attacks [1] because the chips communications with other parts of the board were done in the clear.
So it was/is recommended to use a pin/key and/or recovery key to ensure the security of the data. Unless your only threat model was to protect against common thievery and assume the attack had no technical prowess (and that’s perfectly fine, I do this for my company). Not to mention they were kinda used as a warranty canary for Truecrypt [2]. There were suspicions that nation states may have hardware bypasses worked out.
Later there were implementations of hardware encryption found to be vulnerable. So even now bitlicker does everything in software by default. [3]
So I understand why FOSS devs would rely more on standard practice (shared keys) with LUKS and not embrace hardware enclave options like TPM. They haven’t been the most reliable over the long term and are harder to patch/fix.
[1] https://pulsesecurity.co.nz/articles/TPM-sniffing
[2] https://threatpost.com/of-truecrypt-and-warrant-canaries/106355/
[3] https://www.technadu.com/bitlocker-to-use-software-encryption-on-windows-10/54907/
The "mitigation" itself is still not very safe if you're paranoid about governments or very motivated organisations. The extra step of checking PCR12 is performed by the initrd that you trust because it's signed by a private key that has probably leaked to every serious hacking corp / government. They can just boot their own signed initrd and kindly ask the TPM that will oblige.
I personally replace the firmware certificates (PK, KEK, db, dbx, …) with my own and sign every kernel/initrd update, I also unlock my disks with a passphrase anyways, but I'm on the fence WRT if it's more secure than TPM.
Yes in theory TPM key extraction is feasible (and even easy if it's performed by a chip other than your CPU https://pulsesecurity.co.nz/articles/TPM-sniffing ) but it is harder than filming/watching you type the passphrase or installing a discrete key-logger ?
Sniffing the TPM's been available for quite some time, actually - and quite cheap!
https://pulsesecurity.co.nz/articles/TPM-sniffing
The best way would be to arguably keep the key completely off the TPM and use remote attestation. There's some preboot products out there like WinMagic SecureDoc* that use a little Linux partition, spin up just enough to get a network connection up to a remote server, provide authentication services, and then send the Bitlocker key down, unlock the partition, and chainload onwards to Windows.
* I acquired an enterprise device on eBay and was VERY surprised to find this product on it as the preboot protector. Zero way to crack in from my end, so I applaud it. There's even some MFA solutions they offer around this! https://winmagic.com/en/solutions/mfa-windows-login/
> If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash.
You can't easily do that as the platform control headers will be different to those set by Windows. You can't brute-force it as they have a realtime clock and lock after about 32 attempts, granting one more attempt for each ten minutes. Getting the bit-locker key from a discrete TPM v1.2 or v2.0 requires being a bus pirate [1]. Getting it from a "soft" TPM inside a CPU is likely much, much harder.
[1] https://pulsesecurity.co.nz/articles/TPM-sniffing
I think OP’s point is that singling out BitLocker when the attack is not specific to it is misleading. It leaves the wrong impression that other methods relying on the same key exchange mechanism are safe.
Name dropping BitLocker was one sure way to gather attention for something that had been proven years ago, and had already reached a “close enough for all intents and purposes” price point [0]. Not unlike name dropping Tesla or Apple even for mundane things.
[0] https://pulsesecurity.co.nz/articles/TPM-sniffing
I think if you have Bitlocker set up with a boot password, and you are careful to shut down when you're not using the computer, then you're probably fine. But in my experience most people use Bitlocker just with the Windows login prompt.
As I understand it, the FPGA is able to initiate the TPM key extraction, yes. So it's not a sniffer that has to wait for the user to input the password.
https://pulsesecurity.co.nz/articles/TPM-sniffing