Lol, Tom's hardware is allowed on lemmy? It's like the fox news of the tech world.
Clickbait as usual.
this post was submitted on 07 Feb 2024
735 points (97.7% liked)
Technology
59192 readers
2438 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Them government backdoors. Mkay trust us mkay
Hi this is BitLockPickingLawyer here and today we'll see how secure . . .
A click out of one... two is binding...
Question: if I have an bitlocker encrypted SSD in a modern computer with embedded TPM, can I move this SSD to an old computer with external TPM to sniff the cod this way? Be gentle. I am dumb. Thanks.
The Key is stored on the Internal TPM. Only it can unlock the SSD.
"Sniff the cod" This is a typo right? I don't know any better, but I had a good laugh.
What about the salmon and the halibut? :-D
Nope. As soon as you move the disk to your second system/TPM, you lose any ability to decrypt it at all.
unless you have the key?
The key is inside the TPM.
For LUKS user set the key; for bitlocker, I believe the key is automatically uploaded to either your Microsoft account or you system admin's account.
Sure LUKS will do what you tell it. Bitlocker will do what it wants and just use the TPM unless you jump through a bunch of group policy edits and such. But you are correct, I had forgotten it does give you the option to backup the key to a txt file during the installation or initial encryption process :)
Not unless you entered your recovery code to unlock it on the old computer with the external tpm.
Say it with me now: LUUUUUKS
LUKS is still vulnerable to this attack if you enable autodecrypt using TPM. This attack is based on the vulnerability that the CPU and TPM communicates uses plain text. And it is a pretty common attack against TPM:
https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network
SPI is a communication protocol for embedded systems and is extremely common amongst virtually all hardware. Due to its simplicity, there is no encryption option for SPI. Any encryption must be handled by the devices themselves. At the time of this writing BitLocker does not utilize any encrypted communication features of the TPM 2.0 standard, which means any data coming out of the TPM is coming out in plaintext, including the decryption key for Windows
And apparently Linux is not doing too hot on this regard either:
https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets
As we can see, parameter encryption simply isn't used in practice, and except for safeboot none of the solutions enforce PIN/MFA by default.
However, this attack is not viable for device with firmware based solution, like fTPM, Microsoft Pluton, secure enclave etc. in these case TPM is part of the cpu, hence have no exposed pins to sniff their connection.
So if you don't want people with physical access to your computer (a thief or a evil maiden) to access everything on your disk, don't setup TPM auto decrypt.
CPU communicates with TPM in plaintext
Because of course
CPU doesn't have any secure storage, so it can't encrypt or authenticate comms to the TPM. The on-CPU fTPMs are the solution, the CPU then has the secure storage.
That make sense, CPU has no place to store private keys, since that is the functionality of TPM...
Unless there is a firmware solution, which defeats the purpose of a standalone tpm.
I wondered why LUUUUUKS didnt use the TPM, why do i have to put my password in... this is absolutely why.
Edit: fixed spelling of LUUUUUKS
What exactly is the point of full disk encryption if the system auto-unlocks on boot?
Protection against tampering, maybe?
Bad excuse, but that is the logic I've heard.
Also yes you can, I wouldn't recommend it though. Maybe in addition to your password though.
Wait until you see Dracut and Tang.
It seems to me an evolution on this attack: https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/
Very end of the article explains you need access to the TPM communication hardware, which no longer occurs external to Intel and And cpus
So offline (external) bitlocker drives that are unlocked with the key only.
Or internal bitlocker drives that are unlocked with AMD fTPM are excluded from this exploit?
Should be noted that if a password is asked to decrypt the drive it also doesn't work.
To *newer Intel and AMD cpus and only certain models.
There's a lot of current hardware that uses embedded TPMs. It also depends on the communication path between the CPU and the module, but chances are it will be clear text and in some, via LPC.
*pretty much all AMD and Intel cpus made after 2015, not sure how a decade is new.
view more: next ›