Top all-time · #2678
Pulse Security
Company blog · pulsesecurity.co.nz/articlessecurity
Pulse Security is the company blog at pulsesecurity.co.nz, writing about security. Since 2019, 28 different Hacker News readers have linked it 30 times, most often “Extracting Bitlocker Keys from a TPM”. It is still writing: the last post was on 2026-08-30, and you can follow it by feed.
Technical Information Security Services. Offensive Security, Penetration Testing, Mobile and Application, Infrastructure, Digital Forensics, Incident Response
Most-linked posts?
- Extracting Bitlocker Keys from a TPM16 people · 17 mentions · first linked 2019-03-13
- Brute Forcing TOTP Multi-Factor Authentication Is Surprisingly Realistic2 people · 2 mentions · first linked 2022-09-18
- Mashing Enter to bypass full disk encryption with TPM, Clevis dracut and systemd2 people · 2 mentions · first linked 2023-09-01
What Hacker News says?
> Can you even get the secret from the TPM in recovery mode? Given that you can (relatively trivially) sniff the TPM communication to obtain the key [1], yes it should be possible. Can't verify it though as I've long ago switched to Mac for my primary driver and the old cheesegrater Mac I use as a gaming rig doesn't have a hardware TPM chip. [1] https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “CrowdStrike Update: Windows Bluescreen and Boot Loops”Submitted Zerotier – multiple vulnerabilities lead to private network access as a story · 135 points
HN discussionthis presumes that anyone would trust bitlocker. https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “Is Tor still safe to use?”Submitted Extracting Bitlocker Keys from a TPM as a story · 112 points
HN discussionTPM, at least older version <1.2 were still subject to physical key exfil attacks [1] because the chips communications with other parts of the board were done in the clear. So it was/is recommended to use a pin/key and/or recovery key to ensure the security of the data. Unless your only threat model was to protect against common thievery and assume the attack had no technical prowess (and that’s perfectly fine, I do…
Comment linking /articles/TPM-sniffing
on “Microsoft no longer signs Windows drivers for Process Hacker”Submitted Mashing Enter to bypass full disk encryption with TPM, Clevis dracut and systemd as a story · 8 points
HN discussionI wonder if there is a way to solve TPM sniffing attacks: https://pulsesecurity.co.nz/articles/TPM-sniffing https://news.ycombinator.com/item?id=19379092
Comment linking /articles/TPM-sniffing
on “Authenticated Boot and Disk Encryption on Linux”Submitted Binary patching Go's Net/HTTP to get the true HTTP headers as a story · 4 points
HN discussionThe "mitigation" itself is still not very safe if you're paranoid about governments or very motivated organisations. The extra step of checking PCR12 is performed by the initrd that you trust because it's signed by a private key that has probably leaked to every serious hacking corp / government. They can just boot their own signed initrd and kindly ask the TPM that will oblige. I personally replace the firmware cer…
Comment linking /articles/TPM-sniffing
on “Bypassing disk encryption on systems with automatic TPM2 unlock”Submitted Airtable Formula Injection - abusing formulas to steal data as a story · 3 points
HN discussionI think if you have Bitlocker set up with a boot password, and you are careful to shut down when you're not using the computer, then you're probably fine. But in my experience most people use Bitlocker just with the Windows login prompt. As I understand it, the FPGA is able to initiate the TPM key extraction, yes. So it's not a sniffer that has to wait for the user to input the password. https://pulsesecurity.co.nz/…
Comment linking /articles/TPM-sniffing
on “DPAPI security flaw in Windows 10”Submitted Bypassing USBGuard on Linux as a story · 3 points
HN discussionI think OP’s point is that singling out BitLocker when the attack is not specific to it is misleading. It leaves the wrong impression that other methods relying on the same key exchange mechanism are safe. Name dropping BitLocker was one sure way to gather attention for something that had been proven years ago, and had already reached a “close enough for all intents and purposes” price point [0]. Not unlike name dro…
Comment linking /articles/TPM-sniffing
on “BitLocker encryption broken in 43 seconds with sub-$10 Raspberry Pi Pico”Submitted A Few Tailscale Tricks for Security Testers as a story · 3 points
HN discussionI say its more likely the researcher found article from 2019 https://pulsesecurity.co.nz/articles/TPM-sniffing describing this very attack vector using FPGA dev board. The only novel thing here is price point going down by a factor of x10 to $5-10.
Comment linking /articles/TPM-sniffing
on “BitLocker encryption broken in 43 seconds with sub-$10 Raspberry Pi Pico”Submitted Brute Forcing TOTP Multi-Factor Authentication Is Surprisingly Realistic as a story · 2 points
HN discussionYes, and yes - the LPC bus is standardized, and TPMs need to use the same protocol to enable them to be modules on the motherboard. And yes, it's only $10 or thereabouts for a logic analyzer that can decode LPC bus communications. 2019 ref - https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “BitLocker encryption broken in 43 seconds with sub-$10 Raspberry Pi Pico”Submitted Mashing Enter to bypass [FDE] with TPM, Clevis, dracut and systemd as a story · 1 points
HN discussionTPM 2.0 allows communications over the bus to be encrypted specifically to prevent this attack, though Windows apparently does not actually use this feature[0]. Newer CPUs (since about 5 years ago) have the TPM embedded in the CPU. Intel calls this PTT and AMD calls it fTPM. [0] https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “TPM Sniffing”Submitted Azure DevOps CICD Pipelines – Command Injection and a Runner Hijacking as a story · 1 points
HN discussionBecause of fun probability stuff. The fact what your guessing changes doesn’t matter. It’s still a day to get a correct guess. https://pulsesecurity.co.nz/articles/totp-bruting
Comment linking /articles/totp-bruting
on “Speak Friend and Enter – Do people use movie passwords? (2018)”Submitted Authentication Security Controls You Might Be Missing as a story · 1 points
HN discussionYou can generally sniff the LPC bus to the TPM. Even with TPM2.0+ that allows optional encryption on the transport layer, Windows dosn't bother using it. https://pulsesecurity.co.nz/articles/TPM-sniffing But I was referring more to a malicious software component between the data flow between the user interface and the TPM, even before the TPM's protocol stack is in the loop.
Comment linking /articles/TPM-sniffing
on “Bitwarden PINs can be brute-forced”Submitted SQL Injection and Postgres – An adventure to eventual RCE as a story · 1 points
HN discussion> If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash. You can't easily do that as the platform control headers will be different to those set by Windows. You can't brute-force it as they have a realtime clock and lock after about 32 attempts, granting one more attempt for each ten minutes. Getting the bit-locker key from a disc…
Comment linking /articles/TPM-sniffing
on “Initial support for guided disk encryption in OpenBSD installer”Submitted Untitled Goose Game – Insecure Deserialization as a story · 1 points
HN discussionUpdate. There were successful TPM attacks by sniffing data from LPC bus wires connecting TPM chip by HW logic analysers. The data is unecripted. "TPM2.0 devices support command and response parameter encryption, which would prevent the sniffing attacks. Windows doesn’t configure this though,". This prevents bare-metal in datacenter use case. https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “Linux disk encryption using hardware TPM (Trusted Platform Module)”Sniffing the TPM's been available for quite some time, actually - and quite cheap! https://pulsesecurity.co.nz/articles/TPM-sniffing The best way would be to arguably keep the key completely off the TPM and use remote attestation. There's some preboot products out there like WinMagic SecureDoc* that use a little Linux partition, spin up just enough to get a network connection up to a remote server, provide authentic…
Comment linking /articles/TPM-sniffing
on “Microsoft 0-day feud escalates as researcher threatens another exploit dump”You do know those are trivially bypassed with a signal processor, right? If physical access is outside your threat model, that's OK, but it makes (for example) the forced Win11 upgrade for DRM^H^H^H boot integrity enforcement seem ridiculous. https://pulsesecurity.co.nz/articles/TPM-sniffing
Comment linking /articles/TPM-sniffing
on “News about Raspberry Pi 6 and Microcontroller Development – Jeff Geerling”> It's really annoying how none of these tools provide an easy way to activate the properly fast, zero CPU overhead hardware-based encryption that almost all modern SSDs can do, which also makes it work properly with DirectStorage, etc. Because the situation is similar to Dr. House: All disks lie. An OS can't trust the quality of the encryption in modern SSDs, there is no way short of dedicated hardware and firmware…
Comment linking /articles/TPM-sniffing
on “VeraCrypt: Free, open source, disk encryption for Windows, Mac OS X, Linux”
