Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Extracting Bitlocker Keys from a TPM

pulsesecurity.co.nz

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Extracting Bitlocker Keys from a TPM

#11

Post by e12e »

accrual wrote: post #7
ragona wrote: post #3

Ahhh, I was very concerned until I got to the part about pre-boot verification. That is definitely a critical part of full disk encryption, and should really be the default. (Although I’ll admit that it’s really annoying sometimes.)

I agree the pre-boot verification and PIN should be a default. Otherwise, just having the hardware makes it insecure. All hardware is insecure with physical access of course, but it should be more difficult to access even for someone with a logic analyzer. Regarding annoyance, one of the most significant inconveniences I've experienced is the inability to boot when the hardware changes significantly, e.g. installing…

I guess "standard" bitlocker is just a defense against the "legacy" attack of someone stealing/mirroring your hd;not a defense against the more likely "current" attack of someone stealing your laptop :/

Re: Extracting Bitlocker Keys from a TPM

#12

Post by londons_explore »

pacaro wrote: post #6

FWIW in the earlier days of BitLocker (when it was called cornerstone) a preboot PIN was considered then default secure setting. Working in the 16-bit boot loader places some serious restrictions on numeric text entry. If you have to consider the 100 or so keyboard layouts that windows supported at that time, so the pin was required to be entered using function keys F1 F2 etc. because they’re on all keyboard layouts…

Perhaps it's time to move towards the Android/iOS model of having the OS unencrypted (since that isn't a secret anyway), and only do encryption of all the user data and apps.

That way, the OS can get to the login prompt entirely without secret data.

Obviously that's a big architecture change...

Re: Extracting Bitlocker Keys from a TPM

#13

Post by segfaultbuserr »

josteink wrote: post #9
accrual wrote: post #8

I knew several of the acronyms in the article but some were new to me. Here are some references in case anyone is in the same boat. TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0] PCR: A Platform Configuration Register (PCR) is a memory location…

> TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0] Introduced around the time of Windows Vista by Hollywood to provide unbreakable HW drm throughout the OS. I’ve never once enabled this malicious, user-hostile hardware.

Security modules are prone to abuses by various interest groups, but by themselves, they are never inherently evil or even desirable if it has an open standard, and is under the control of a user.

TPM and trusted computering is an interesting case, it was originally planned to be the foundation of an unbreakable DRM system, however, this didn't go according to the plan. To this day, the most harmful result was Secure Boot and Boot Guard, but the TPMs are never used in any significant DRM systems. Today it's genuinely a security tool under user's control.

For example, see my explanation of how TPM-backed verified boot can help ensuring integrity of BIOS and bootloader.

https://news.ycombinator.com/item?id=18034227

Quote Richard Stallman,

As of 2015, treacherous computing has been implemented for PCs in the form of the “Trusted Platform Module”; however, for practical reasons, the TPM has proved a total failure for the goal of providing a platform for remote attestation to verify Digital Restrictions Management. Thus, companies implement DRM using other methods. At present, “Trusted Platform Modules” are not being used for DRM at all, and there are reasons to think that it will not be feasible to use them for DRM. Ironically, this means that the only current uses of the “Trusted Platform Modules” are the innocent secondary uses—for instance, to verify that no one has surreptitiously changed the system in a computer.

Therefore, we conclude that the “Trusted Platform Modules” available for PCs are not dangerous, and there is no reason not to include one in a computer or support it in system software.

https://www.gnu.org/philosophy/can-you-trust.html

Re: Extracting Bitlocker Keys from a TPM

#14

Post by segfaultbuserr »

I find the title is misleading, it did not "extract" Bitlocker keys from the inside of a TPM at all, but merely sniffed the key material on the bus. I was so excited to see the title, and so disappointed after reading it...

Sniffing keys on the bus and extracting keys from a TPM are very different scenarios. If you can "extract keys from a TPM", it means you must have found a way to tamper the chip using a piece of semiconductor test equipment and to obtain it from the circuity via a microprobe (or somehow injecting a spurious signal externally), bypassing any verification and self-protections of the chip.

TPMv2-like security chips are usually implemented by a secure microcontroller core. The internal is mostly a secret, and there is little public information about its internal construction, public audits on their actual resistance against various forms of attacks is almost non-existent. Even obtaining these microcontrollers are difficult, usually even the basic datasheet is beind multiple NDAs, and their availability is usually highly restricted, they don't sell these microcontroller cores to ordinary people.

If you have broken it, it would be the breaking news in the infosec community. It means you would be possible to completely decrypt the entire harddrive (if no additional key is used) given a random computer without preconditions, and everyone would have an idea about how secure these chips actually are.

I suggest changing the title to "Sniffing Bitlocker Keys from a TPM".

Re: Extracting Bitlocker Keys from a TPM

#15

Post by amluto »

reggie14 wrote: post #5
amluto wrote: post #4

SGX could mitigate this — it’s much more resistant to this type of attack than the TPM.

How? The lack of trusted I/O in SGX seems like it would make secure disk encryption rather hard. You still need to use something like a password for access control. While it can be mixed with a key in SGX, you have to get that password into SGX from untrusted space. At least in the TPM architecture there's some effort to establish a trusted pre-boot environment where you can enter a password/PIN. Then, sure, you coul…

You make a little enclave that (proxied through the host) gets the TPM to attest online to the relevant PCRs. Then the enclave gives the host the VMK.

Sure, one could then run this enclave under malicious control, but the attacker now has to do that live while the TPM thinks the system is okay. This requires active attack instead of passive attack. (Or it requires a DMA attack.) So the bar is a bit higher.

Re: Extracting Bitlocker Keys from a TPM

#16

Post by GordonS »

ragona wrote: post #3

Ahhh, I was very concerned until I got to the part about pre-boot verification. That is definitely a critical part of full disk encryption, and should really be the default. (Although I’ll admit that it’s really annoying sometimes.)

When I first setup Bitlocker on Windows 10, I was hunting for the option to enter a pre-boot password, but couldn't find it. I don't even think it have me the option of entering a PIN.

For some reason, if you have a TPM installed you need to jump through hoops to add a pre-boot PIN, and more so if you want to enable a pre-boot password. I had to flip various Windows security policy settings before it would work.

a TPM and pre-boot PIN/password work against different attack vectors - I really don't understand why Microsoft would want to hide these options.

Re: Extracting Bitlocker Keys from a TPM

#17

Post by mjg59 »

segfaultbuserr wrote: post #14

I find the title is misleading, it did not "extract" Bitlocker keys from the inside of a TPM at all, but merely sniffed the key material on the bus. I was so excited to see the title, and so disappointed after reading it... Sniffing keys on the bus and extracting keys from a TPM are very different scenarios. If you can "extract keys from a TPM", it means you must have found a way to tamper the chip using a piece of s…

The described attack allows you to recover Bitlocker keys and decrypt the harddrive from any random computer that you have physical access to, since when you boot it the key will be sent over the LPC bus in a way that can be extracted. I'm not sure what the distinction you're making is, given that the probability that someone ends up with access to a TPM but not the system it's associated with is basically zero.

Re: Extracting Bitlocker Keys from a TPM

#18

Post by close04 »

mjg59 wrote: post #17
segfaultbuserr wrote: post #14

I find the title is misleading, it did not "extract" Bitlocker keys from the inside of a TPM at all, but merely sniffed the key material on the bus. I was so excited to see the title, and so disappointed after reading it... Sniffing keys on the bus and extracting keys from a TPM are very different scenarios. If you can "extract keys from a TPM", it means you must have found a way to tamper the chip using a piece of s…

The described attack allows you to recover Bitlocker keys and decrypt the harddrive from any random computer that you have physical access to, since when you boot it the key will be sent over the LPC bus in a way that can be extracted. I'm not sure what the distinction you're making is, given that the probability that someone ends up with access to a TPM but not the system it's associated with is basically zero.

> This post will look at extracting the clear-text key from a TPM chip by sniffing the LPC bus

It is a very interesting read but the title is a bit clickbaity. Luckily it's not with bad intentions, the first few lines (above) already tell you what it is.

> I'm not sure what the distinction you're making is

Imagine I tell you I can extract any information I want from the human brain. You'd be intrigued, how do I interface, how do I extract and process the data. Then I tell you I basically eavesdrop on your conversations.

I understand the end result is the same, the mechanism is compromised but the method makes all the difference to how interested I am in the article. I've read about sniffing already, I was now expecting to read how the TPM chip was "cracked".

Re: Extracting Bitlocker Keys from a TPM

#19

Post by userbinator »

segfaultbuserr wrote: post #13
josteink wrote: post #9

Earlier quoted context omitted.

> TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0] Introduced around the time of Windows Vista by Hollywood to provide unbreakable HW drm throughout the OS. I’ve never once enabled this malicious, user-hostile hardware.

Security modules are prone to abuses by various interest groups, but by themselves, they are never inherently evil or even desirable if it has an open standard, and is under the control of a user. TPM and trusted computering is an interesting case, it was originally planned to be the foundation of an unbreakable DRM system, however, this didn't go according to the plan. To this day, the most harmful result was Secure…

Today it's genuinely a security tool under user's control.

Anything that has hardcoded nearly-impossible-to-extract keys which you don't know, is not under your control.

Re: Extracting Bitlocker Keys from a TPM

#20

Post by gtsteve »

e12e wrote: post #10

This is excellent. I've been wondering/troubled about the ease of use of bitlocker. Nice to get confirmation that standard bitlocker is rubbish against real attackers. Sad however, that the only additional defense appear to be "more blind trust in hardware" and no option for key derived from a passphrase. We know from the Xbox hack that keys in cheap hw isn't secure (enough).

You actually can configure Bitlocker to accept a passphrase instead but the option isn't easy to find.

https://www.windowscentral.com/how-use-bitlocker-encryption-...

Post reply on HN