Simon Says – Musings of a Technology CTO

Recently it was announced with much fanfare that the now-ubiquitous “TPM” chip found in most modern computers had been hacked. This obviously unnerved a lot of people, especially those hanging the safety of their secrets on free solutions like Microsoft Bitlocker which use the TPM to provide convenience to their users.

The attack, invented about 60 years ago, but elegantly implemented by Christopher Tarnovsky of Flylogic involved attacking the hardware of the chip itself by uncasing it and probing its signal pathways – something that seems difficult until you read their blog and realize they do it every day.

Chris used a combination of off-the-shelf acids and rust-remover solutions to dissolve first the outer casing of the chip, then the wire grid tamper-proofing shields inside.

Once “undressed” he was able to probe and monitor what was going on inside anonymously.

The Trusted Computing Module, or TPM is used in a variety of “secure” devices, such as Microsoft’s Xbox 360, smart phones, satellite TV receivers, and of course most laptops and desktops. The chip in question, made by Infineon, is often advertised as “Tamper proof” – but reading between the lines this seems to apply to the software interfaces.

The chip is also CC EAL4 certified, and “TCG Certified” – neither of these seem to specifically apply to attacks on the physical chip itself. The encapsulation seems to be considered enough of a barrier to thwart the average attack scenario.

There were also attacks on the LPC bus (Low-Pin-Count) of the TPM a few years ago, when researchers such as Bernard Kauer http://os.inf.tu-dresden.de/papers_ps/kauer07-oslo.pdf used simple hardware to eavesdrop on the communications with the external interfaces of the chip ( http://rdist.root.org/2007/07/16/tpm-hardware-attacks/ and http://rdist.root.org/2007/07/17/tpm-hardware-attacks-part-2/ ).

The TCG group considers these kind of attacks as outside the scope of the design:

“The commands that the trusted process sends to the TPM are the normal TPM commands with a modifier that indicates that the trusted process initiated the command… The assumption is that spoofing the modifier to the TPM requires more than just a simple hardware attack, but would require expertise and possibly special hardware.”

– Proof of Locality (section 16)

Unfortunately as we see, in the real world this expertise and “special hardware” is becoming more common.

So, what does this mean in real terms?

1. The TPM is hardware exploitable, and can be provably forced to reveal its secrets
2. The TPM is bus-exploitable and SMX exploitable
3. Hardware attacks are outside the scope of protection that the current chip design was built to prevent
4. With effort and dedication, TPM has been proven to give up its secrets – in fact if you read FlyLogic’s blog (http://www.flylogic.net/blog/), you’ll see they do it for fun!

There’s still no substitute for plain-old password based authentication it seems. Once you give up the keys to hardware which does self-validation, there are more and more possible exploits, which although “exotic” are far more practical than we first assume.