This is a little silly because this assumes that BitLocker is configured for TPM-only rather than requiring a TPM PIN/password.<p>If there's a TPM password, this attack becomes infeasible because the TPM won't release the keys without the password. And you generally can't brute force the TPM without triggering the hardware lockout.<p>The company's IT department can require TPM+Password in Group Policy so that every system in the organization uses TPM+Password, but I guess you could have a stubborn CEO who demands a less secure policy.<p>As of Windows 8, it was possible to replace ciphertext on a BitLocker-encrypted drive to compromise known Windows binaries.[0] This would allow the attacker to take control of the system on next boot, though I don't know if those attacks are still practical.<p>[0] <a href="https://cryptoservices.github.io/fde/2014/12/08/code-execution-in-spite-of-bitlocker.html" rel="nofollow">https://cryptoservices.github.io/fde/2014/12/08/code-executi...</a>
That's why you should also consider fancy nail polish an effective canary to evil maid attacks.<p><a href="https://www.computerweekly.com/blog/CW-Developer-Network/F-Secure-glams-up-laptop-security-with-glitter-nail-polish" rel="nofollow">https://www.computerweekly.com/blog/CW-Developer-Network/F-S...</a>
It’s an interesting thought experiment but not much else. Most of what he’s doing is predicated on the idea that any major CEO is walking around with a 7 year old laptop that is both well documented online and not configured with TPM + password which pretty much any competent IT department is going to require of an executive’s device.
I'm skeptical as to whether this can really be done in 10 mins. Finding the right chip can take a good while and especially tracing the bus you need to other chips. And the fact the traces were accessible with the thing semi-assembled is incredibly lucky, not to mention how he was able to find a "schematic" of the motherboard. I'd say an hour to pull this off is a minimum.
On Dell devices in that age range I saw a bitlocker mode that used the drive controllers own encryption feature. I dont remember if the key was provided by tpm but they used attestation. I dont know if they had a key unwrap dependent on that attestation or if it was just a postfactum check that is submitted to management servers.<p>In that course I have seen a bunch of blog posts where people found bugdoors or easy auth bypasses in these drive controller encryption schemes. Is that still a thing?
What fascinates me most is how quick this can be done. If you do your "homework" and find out which device needs to be attacked, you can really set everything up in advance and can be done in no time. Amazing and shocking at the same time.
Please. <i>Please.</i> Twitter people, hear my plea.<p><i>Twitter sucks ass and I don't want to scroll for a week to read your blog post.</i> Please, <i>please</i>, just copy+paste it into a blog post and link to it on your Twitter. I swear I will "like & subscribe" to your Blog if you're worried about not getting enough eyeballs. I just do not want to ever have to look at Twitter.
Ultimately I guess the best solution here is something like intel PTT where the TPM is on-chip, or otherwise some sort of soldered shared secret / keys that the TPM and CPU have for encrypted communications over the bus.