Mashing Enter to bypass full disk encryption with TPM, Clevis dracut and systemd

Meh, it's an interesting exploit for sure (the USB key simulating Enter key being pressed every 15ms is cute).

But IMO unless you run a very hardened setup, protecting against evil maid attacks (wherein the attacker has physical access to your machine in its entirety) is really hard, and possibly always will be. In a hardened setup you lock down the emergency initrd shell - either it's not allowed at all, or it uses a password which hopefully is a little more secure against an attacker pressing the Enter key a lot ;)

The real eye opener for me is what Ventoy can do. You can plug it into a computer with Secure Boot enabled, and it will give you a nice user-friendly way to just ... completely and trivially bypass Secure Boot protection. Yes, really: https://www.ventoy.net/en/doc_secure.html

It won't work for every mobo/firmware combo. It worked first try for me on some used Lenovo ThinkCentre M710q I bought on eBay, though. Even with the latest June 2023 BIOS installed.

Ventoy does this by using a known exploit in a GRUB shim that is signed with the official Microsoft certs (that ones that are embedded in virtually every mobo sold with Secure Boot support), in order to pop the KeyEnroll UEFI application and then enroll its own keys in there. Or something like that.

Sure, M$ put out a windows update ages ago that updates the DBX to prevent this particular signed shim with known vulnerabilities: https://support.microsoft.com/en-us/topic/kb5012170-security... ... but who knows how many more are out there in the wild?

Once you've pwned Secure Boot (and I'm making the case here that any script kiddy can do this on a vast majority of commonly available/used mobos, let alone a professional cybercrime gang/local LE division or, god-forbid, 3 letter agency), then you can simply pop in your favourite (Arch, obviously) Linux live USB and `cryptsetup open` your favourite encrypted drive in seconds.

For unattended machines, especially if you've already bothered to stick a Clevis in there, you really ought to blend your TPM ping with a SSS (min 2) one-two combo-punch of a Tang pin.

But again, if the attacker is literally sitting at your desk typing in your computer connected to your trusted networks and such, you're always gonna be pretty screwed.

Also seeing infinite Captcha loop, not on Cloudflare DNS.

> There's no viable reason to reboot a Linux box.

Even cosmic rays flipping bits in your RAM in a way that can't be recovered from?

The best hacker I know is my 12 month old.

Give him any kind of device for 2 minutes and you will discover a plethora of UI issues, hidden menus, and security bypasses.

You raise a valid point, but this attack is particularly alarming because it circumvents a TPM, which is a hardware module that was specifically designed to protect against evil-maid class of attacks, e.g. every iPhone after the 5S uses its Secure Enclave (a TPM) to enforce time delays between passcode attempts [0], so that a physical attacker can't brute force the passcode. (Incidentally, the attack described in the OP is reminiscent of some early attacks against the iPhone that used an HID device to circumvent passcode rate limiting.)

IMO, the continuing difficulty that the FBI has breaking into seized iPhones is proof that it's possible to ship a device with hardware that is sufficiently secure to mitigate against any physical exfiltration of data, but this is probably only possible because of the fully vertical integration of Apple hardware, firmware, and software (and even then - it's still a cat and mouse game, bugs will eventually be exposed, etc.). For open source software that runs on any arbitrary assemblage of hardware components, I suspect it's nigh impossible to achieve this same level of physical security.

[0] https://support.apple.com/en-gb/guide/security/sec20230a10d/...