LPC Bus Sniffing Attack against Microsoft BitLocker in TPM-only Mode

In this SySS (https://www.syss.de/) proof-of-concept video, a sniffing attack against the Low Pin Count (LPC) bus communication of a trusted platform module (TPM) is demonstrated using the developed iCEstick LPC TPM Sniffer for the Lattice iCEstick Evaluation Kit [1].

This attack can be used to extract cryptographic keys (so-called Volume Master Keys [VMK]) used by the Microsoft BitLocker full-disk encryption when configured in TPM-only mode. Having access to the VMK enables an attacker to gain read and write access to the cleartext data of an encrypted BitLocker partition.

Hector Martin mentioned this attack last year on Twitter [2], and a few weeks later Denis Andzakovic published a blog article with the title "Extracting BitLocker Keys from a TPM" [3] where he described his approach in reproducing this LPC bus sniffing attack.

Our used iCEstick LPC TPM Sniffer [4] is a slightly modified and refactored version of the LPC Sniffer [5] by Alexander Couzens with TPM-specific modifications by Denis Andzakovic [6] which can be used to perform this kind of attack more easily.

In this demo video, a current Windows 10 system with Microsoft BitLocker in TPM-only mode and an ASUS TPM-M R2.0 [7] using an Infineon SLB 9665 TT 2.0 [8] chip is attacked.

The intention for this proof-of-concept video was to raise awareness for this possible LPC bus sniffing attack concerning the BitLocker TPM-only mode.

We do not recommend using BitLocker in TPM-only mode but with a pre-boot authentication (PBA) requiring one or more authentication factor (also see Microsoft's BitLocker recommendations [9]).

[1] Lattice iCEstick Evaluation Kit
http://www.latticesemi.com/icestick

[2] Tweet regarding LPC bus sniffing attack against BitLocker TPM-only mode, Hector Martin, 2019
  / 1080869868889501696  

[3] Extracting BitLocker Keys from a TPM, Denis Andzakovic, 2019
https://pulsesecurity.co.nz/articles/...

[4] SySS iCEstick LPC TPM Sniffer, Matthias Deeg, SySS GmbH, 2020
https://github.com/SySS-Research/ices...

[5] LPC Sniffer, Alexander Couzens, 2017
https://github.com/lynxis/lpc_sniffer/

[6] LPC Sniffer TPM, Denis Andzakovic, 2019
https://github.com/denandz/lpc_sniffe...

[7] ASUS TPM-M R2.0
https://www.asus.com/Motherboard-Acce...

[8] Infineon SLB 9665 TT 2.0 TPM
https://www.infineon.com/cms/en/produ...

[9] BitLocker Countermeasures, Microsoft, 2019
https://docs.microsoft.com/en-us/wind...


#BitLocker #TPM #iCEstick