Top all-time · #4429
SCRT Team Blog
Company blog · blog.scrt.chsecurity
SCRT Team Blog is the company blog at blog.scrt.ch, writing about security. Since 2013, 17 different Hacker News readers have linked it 20 times, most often “TPM Sniffing”. It is still writing: the last post was on 2026-10-06, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
Linked for security research on TPM, BitLocker and disk encryption, such as TPM bus sniffing, voltage glitching and privilege escalation, and for a Twitch chat RCE tied to an OBS CEF update.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- TPM Sniffing4 people · 4 mentions · first linked 2021-11-17
- /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/2 people · 5 mentions · first linked 2026-05-14
- How one Twitch chat message became code execution on a streamer’s PC2 people · 2 mentions · first linked 2026-09-26
What Hacker News says?
> Updated CEF from 127/6533 to 150/7871 Finally... The CEF they used was 2 years out of date, and after RCE exploits [0] occuring in the wild getting big enough that they got picked up in the media [1], we finally have a fix 1 month later. [0] https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-... [1] https://news.ycombinator.com/item?id=49852143 [2] https://www.scworld.com/brief/vulnerable-obs-overlay-and-…
Comment linking /2026/09/22/how-one-twitch-chat-message-became-code-execution-on-a-streamers-pc/
on “OBS Studio 33”Submitted Remote Code Execution on a Facebook server as a story · 877 points
HN discussionFound the article where I read about PCR 7+11 being the default [1]. The reason I looked it up is because if this is actually true, and the TPM is built into the cpu, what prevents someone from placing the cpu and disk on another motherboard? Say that you have disabled usb booting and secured UEFI settings with a password. If you extract the cpu (and thereby its tpm) and the disk, then you'd still be able to boot, r…
Comment linking /2023/09/15/a-deep-dive-into-tpm-based-bitlocker-drive-encryption/
on “Dumping Memory to Bypass BitLocker on Windows 11”Submitted TPM Sniffing as a story · 104 points
HN discussionIndeed! Voltage glitching was used to jailbreak Tesla recently! I believe it was also used to jailbreak the Nintendo Switch. If a discrete TPM (separate chip on the mobo, rather than an fTPM which runs in the CPU/SoC) is in use, one can also use bus sniffing to pwn TPM protection: https://blog.scrt.ch/2021/11/15/tpm-sniffing/
Comment linking /2021/11/15/tpm-sniffing/
on “Mashing Enter to bypass full disk encryption with TPM, Clevis dracut and systemd”Submitted How one Twitch chat message became code execution on a streamer’s PC as a story · 67 points
HN discussionI was given this article after posting the previous one elsewhere: https://blog.scrt.ch/2024/10/28/privilege-escalation-through... This one does say "it appears that the user’s PIN is sent to the TPM which releases the intermediate key only if the provided secret is correct, thus effectively preventing offline bruteforce attacks." Given this, I can't see how it would be possible for anything like YellowKey to work o…
Comment linking /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/
on “Mystery Microsoft bug leaker keeps the zero-days coming”Submitted MongoDB Zero Day Exploit as a story · 20 points
HN discussionThe only evidence I have seen was this article that another user in the thread shared: https://blog.scrt.ch/2024/10/28/privilege-escalation-through... Not saying you're wrong, I'm just not sure how well known it really is. Either way... if the TPM is the one gating the key behind a PIN, I really don't see how an OS-level exploit can work without knowing the PIN in advance.
Comment linking /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/
on “Microsoft BitLocker – YellowKey zero-day exploit”Submitted Exploiting a misused C++ shared pointer on Windows 10 as a story · 4 points
HN discussion> If the TPM required a PIN to extract anything, I think there would be no need to manually decrypt anything in software as they show with the python code. Like I specifically pointed out, it's belt and suspenders. > Of course I could be wrong... please feel free to provide more info. From https://blog.scrt.ch/2024/10/28/privilege-escalation-through... : > Indeed, by analysing the decryption process, it appears that…
Comment linking /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/
on “Microsoft BitLocker – YellowKey zero-day exploit”Submitted SonicDoor – Cracking SonicWall's SMA 500 as a story · 2 points
HN discussionhttps://blog.scrt.ch/2024/10/28/privilege-escalation-through... https://post-cyberlabs.github.io/Offensive-security-publicat... Yes, the PIN is entangled with the key material. The admin PIN recovery techniques all involve enrolling additional unlocking methods. Besides this, I completely agree with this post, especially: > I think the best you can do right now is to layer a password with a hardware device. I don't…
Comment linking /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/
on “Microsoft BitLocker – YellowKey zero-day exploit”Submitted Reinventing PowerShell in C/C++ as a story · 2 points
HN discussionWe can just do research to figure that out? The recent trend towards conspiracy theories against things that are trivially discoverable is so frustrating. https://post-cyberlabs.github.io/Offensive-security-publicat... https://blog.scrt.ch/2024/10/28/privilege-escalation-through... Yes, the PIN is entangled with the key material.
Comment linking /2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/
on “Microsoft BitLocker – YellowKey zero-day exploit”Submitted Engineering Antivirus Evasion as a story · 1 points
HN discussionStill pointless when the key can be sniffed in cleartext by intercepting the communication between the TPM and the CPU [1]. You should always combine it with something only known to the user (i.e. a passphrase). The only attack TPM-backed disk encryption prevents is someone imaging the disk. [1] https://blog.scrt.ch/2021/11/15/tpm-sniffing/
Comment linking /2021/11/15/tpm-sniffing/
on “Just about every Windows/Linux device vulnerable to new LogoFAIL firmware attack”Submitted Numerous Swiss domain names temporarily hijacked as a story · 1 points
HN discussionDid you read any of my referenced links? You cannot state this when the paper and well known attack methods disprove your statement. Bitlocker does not store the keys in the CPU, otherwise a coldboot attack while literally transplanting the physical memory rows to a different machine wouldn't work. And it does. In case you are confusing CPU with a TPM chip, which can optionally store the master volume key but only f…
Comment linking /2021/11/15/tpm-sniffing/
on “Mullvad: Moving our Encrypted DNS servers to run in RAM”At least on my machine, those DLLs are signed (by Intel) - they are just not signed by Mozilla and are not a part of the OS. What you want is already almost possible* in theory, Windows can run code as a Protected Process[1] (even multiple types of them) which not only prevent the loading of non-signed DLLs, but code injection by third party processes (as you can't get a process handle with write access to it's memo…
Comment linking /2021/04/22/bypassing-lsa-protection-in-userland/
on “Letting users block injected third-party DLLs in Firefox”
