Home > Cryptography, Exploits > TPM “Undressed..”

TPM “Undressed..”

Recently it was announced with much fanfare that the now-ubiquitous “TPM” chip found in most modern computers had been hacked. This obviously unnerved a lot of people, especially those hanging the safety of their secrets on free solutions like Microsoft Bitlocker which use the TPM to provide convenience to their users.

The attack, invented about 60 years ago, but elegantly implemented by Christopher Tarnovsky of Flylogic involved attacking the hardware of the chip itself by uncasing it and probing its signal pathways – something that seems difficult until you read their blog and realize they do it every day.

Chris used a combination of off-the-shelf acids and rust-remover solutions to dissolve first the outer casing of the chip, then the wire grid tamper-proofing shields inside.

Once “undressed” he was able to probe and monitor what was going on inside anonymously.

The Trusted Computing Module, or TPM is used in a variety of “secure” devices, such as Microsoft’s Xbox 360, smart phones, satellite TV receivers, and of course most laptops and desktops. The chip in question, made by Infineon, is often advertised as “Tamper proof” – but reading between the lines this seems to apply to the software interfaces.

The chip is also CC EAL4 certified, and “TCG Certified” – neither of these seem to specifically apply to attacks on the physical chip itself. The encapsulation seems to be considered enough of a barrier to thwart the average attack scenario.

There were also attacks on the LPC bus (Low-Pin-Count) of the TPM a few years ago, when researchers such as Bernard Kauer http://os.inf.tu-dresden.de/papers_ps/kauer07-oslo.pdf used simple hardware to eavesdrop on the communications with the external interfaces of the chip ( http://rdist.root.org/2007/07/16/tpm-hardware-attacks/ and http://rdist.root.org/2007/07/17/tpm-hardware-attacks-part-2/ ).

The TCG group considers these kind of attacks as outside the scope of the design:

“The commands that the trusted process sends to the TPM are the normal TPM commands with a modifier that indicates that the trusted process initiated the command… The assumption is that spoofing the modifier to the TPM requires more than just a simple hardware attack, but would require expertise and possibly special hardware.”

– Proof of Locality (section 16)

Unfortunately as we see, in the real world this expertise and “special hardware” is becoming more common.

So, what does this mean in real terms?

  1. The TPM is hardware exploitable, and can be provably forced to reveal its secrets
  2. The TPM is bus-exploitable and SMX exploitable
  3. Hardware attacks are outside the scope of protection that the current chip design was built to prevent
  4. With effort and dedication, TPM has been proven to give up its secrets – in fact if you read FlyLogic’s blog (http://www.flylogic.net/blog/), you’ll see they do it for fun!

There’s still no substitute for plain-old password based authentication it seems. Once you give up the keys to hardware which does self-validation, there are more and more possible exploits, which although “exotic” are far more practical than we first assume.

  1. Azu
    February 16, 2010 at 14:55

    “free solutions like Microsoft Bitlocker”?? I thought you had to buy a $200 OS for that?

  2. Simon Hunt
    February 16, 2010 at 14:57

    my goodness, how right you are Azu! 😉

  3. February 18, 2010 at 11:37


    Is that quite random? I don`t believe it.

    I mean, who`s such a dumb to use Windows for something, except gaming? In my opinion, it is too easy to hack.

    My neighbour’s son in the age of 12 has cracked his father computer with Windows 7 and UAC… I mean, SHOULD this be possible, for a boy, who normally just use it for Homework, vocabulary training or playing some games (without administrator-privileges and forced uac)…

    However, this really shocked a lot of people… Better, you use open hardware cryptography, to secure data!
    Of course, stealing an external Stick is easier, but in fact a well BIOS-locked system is worthless for a thief and the data is secure!#

    an open hardware cryptography project… In my opinion better than TPM!

  4. Simon Hunt
    February 18, 2010 at 12:18

    Most of the world uses Windows for something other than Gaming Netzblockier, and I’m not sure what you mean by “Cracked” UAC – perhaps you have a link describing the exploit?

    Regardless though, this was not an attack on Windows, this was an attack on a tamper-proofed Chip, the same chip used to protect many operating systems and hardware devices. I hope this isn’t just a petty “*nux vs Windows” comment?

  5. Azu
    February 18, 2010 at 12:36

    I’m not sure which exploit he’s referring to, but Microsoft seem to think it’s more a design feature than a mistake (meaning they won’t fix it).


    Apparently Vista is just as vulnerable, according to Microsoft. I heard about an exploit a while ago but it was only for Windows 7.

  6. Simon Hunt
    February 18, 2010 at 12:42

    This attack has nothing to do with the OS – they are cutting into the chip itself and probing it directly.

  1. April 6, 2010 at 10:04

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: