▲ 737 ▼ BitLocker encryption broken in less than 43 seconds with sub-$10 Raspberry Pi Pico — key can be sniffed when using an external TPM (www.tomshardware.com) submitted 2 years ago by throws_lemy@lemmy.nz to c/technology@lemmy.world 69 comments fedilink hide all child comments
[–] CyberSeeker@discuss.tchncs.de 141 points 2 years ago (3 children) When using an external TPM. Which next to no one does. permalink fedilink source hideshow 6 child comments replies: [–] Shadow@lemmy.ca 116 points 2 years ago* (3 children) Watch the video. It just means external to the CPU, not an external device. They demo the attack on a Lenovo laptop in the first minute of the video. Edit: nm I just realized that was a 10 year old laptop and they're in all the modern procs. I'm a lot less impressed now. Sounds like intel has external and amd internal with their ftpm? permalink fedilink source parent hideshow 6 child comments replies: [–] Lazarus@kbin.social 56 points 2 years ago Many systems still use discrete tpms. Just because the CPU has a virtual tpm function doesn’t mean it’s used permalink fedilink source parent [–] throws_lemy@lemmy.nz [S] 31 points 2 years ago (1 child) fTPM has a bug, don't know if it's fixed https://www.techspot.com/news/93684-amd-promises-fix-ftpm-issue-causes-stuttering-freezes.html Veracrypt also doesn't recommend using encryption that relies on TPMs Some encryption programs use TPM to prevent attacks. Will VeraCrypt use it too? No. Those programs use TPM to protect against attacks that require the attacker to have administrator privileges, or physical access to the computer, and the attacker needs you to use the computer after such an access. However, if any of these conditions is met, it is actually impossible to secure the computer (see below) and, therefore, you must stop using it (instead of relying on TPM). If the attacker has administrator privileges, he can, for example, reset the TPM, capture the content of RAM (containing master keys) or content of files stored on mounted VeraCrypt volumes (decrypted on the fly), which can then be sent to the attacker over the Internet or saved to an unencrypted local drive (from which the attacker might be able to read it later, when he gains physical access to the computer). https://veracrypt.eu/en/FAQ.html Let's assume the attackers were law enforcers permalink fedilink source parent hideshow 2 child comments replies: [–] __ghost__@lemmy.ml 9 points 2 years ago This has been fixed for a while now permalink fedilink source parent [+] remotelove@lemmy.ca 1 point 2 years ago [deleted] permalink fedilink source parent [–] Toes@ani.social 18 points 2 years ago (1 child) It's fairly common in business devices before 8th gen Intel. permalink fedilink source parent hideshow 2 child comments replies: [+] thorbot@lemmy.world 1 point 2 years ago [deleted] permalink fedilink source parent [–] Shurimal@kbin.social 1 point 2 years ago The MSI mini-PC-s for office/business use have separate TPM modules on their mobos. I wouldn't be surprised if other mfg-s do this too. permalink fedilink source parent
[–] Shadow@lemmy.ca 116 points 2 years ago* (3 children) Watch the video. It just means external to the CPU, not an external device. They demo the attack on a Lenovo laptop in the first minute of the video. Edit: nm I just realized that was a 10 year old laptop and they're in all the modern procs. I'm a lot less impressed now. Sounds like intel has external and amd internal with their ftpm? permalink fedilink source parent hideshow 6 child comments replies: [–] Lazarus@kbin.social 56 points 2 years ago Many systems still use discrete tpms. Just because the CPU has a virtual tpm function doesn’t mean it’s used permalink fedilink source parent [–] throws_lemy@lemmy.nz [S] 31 points 2 years ago (1 child) fTPM has a bug, don't know if it's fixed https://www.techspot.com/news/93684-amd-promises-fix-ftpm-issue-causes-stuttering-freezes.html Veracrypt also doesn't recommend using encryption that relies on TPMs Some encryption programs use TPM to prevent attacks. Will VeraCrypt use it too? No. Those programs use TPM to protect against attacks that require the attacker to have administrator privileges, or physical access to the computer, and the attacker needs you to use the computer after such an access. However, if any of these conditions is met, it is actually impossible to secure the computer (see below) and, therefore, you must stop using it (instead of relying on TPM). If the attacker has administrator privileges, he can, for example, reset the TPM, capture the content of RAM (containing master keys) or content of files stored on mounted VeraCrypt volumes (decrypted on the fly), which can then be sent to the attacker over the Internet or saved to an unencrypted local drive (from which the attacker might be able to read it later, when he gains physical access to the computer). https://veracrypt.eu/en/FAQ.html Let's assume the attackers were law enforcers permalink fedilink source parent hideshow 2 child comments replies: [–] __ghost__@lemmy.ml 9 points 2 years ago This has been fixed for a while now permalink fedilink source parent [+] remotelove@lemmy.ca 1 point 2 years ago [deleted] permalink fedilink source parent
[–] Lazarus@kbin.social 56 points 2 years ago Many systems still use discrete tpms. Just because the CPU has a virtual tpm function doesn’t mean it’s used permalink fedilink source parent
[–] throws_lemy@lemmy.nz [S] 31 points 2 years ago (1 child) fTPM has a bug, don't know if it's fixed https://www.techspot.com/news/93684-amd-promises-fix-ftpm-issue-causes-stuttering-freezes.html Veracrypt also doesn't recommend using encryption that relies on TPMs Some encryption programs use TPM to prevent attacks. Will VeraCrypt use it too? No. Those programs use TPM to protect against attacks that require the attacker to have administrator privileges, or physical access to the computer, and the attacker needs you to use the computer after such an access. However, if any of these conditions is met, it is actually impossible to secure the computer (see below) and, therefore, you must stop using it (instead of relying on TPM). If the attacker has administrator privileges, he can, for example, reset the TPM, capture the content of RAM (containing master keys) or content of files stored on mounted VeraCrypt volumes (decrypted on the fly), which can then be sent to the attacker over the Internet or saved to an unencrypted local drive (from which the attacker might be able to read it later, when he gains physical access to the computer). https://veracrypt.eu/en/FAQ.html Let's assume the attackers were law enforcers permalink fedilink source parent hideshow 2 child comments replies: [–] __ghost__@lemmy.ml 9 points 2 years ago This has been fixed for a while now permalink fedilink source parent
[–] __ghost__@lemmy.ml 9 points 2 years ago This has been fixed for a while now permalink fedilink source parent
[–] Toes@ani.social 18 points 2 years ago (1 child) It's fairly common in business devices before 8th gen Intel. permalink fedilink source parent hideshow 2 child comments replies: [+] thorbot@lemmy.world 1 point 2 years ago [deleted] permalink fedilink source parent
[–] Shurimal@kbin.social 1 point 2 years ago The MSI mini-PC-s for office/business use have separate TPM modules on their mobos. I wouldn't be surprised if other mfg-s do this too. permalink fedilink source parent