I am using Bitlocker which uses a TPM to unlock the drive. My question is, although TPM provides security against tampering, how is it useful in defending against attacks that involve physical access? An attacker can just power on the computer and then he can carry out other attacks such as cold boot or DMA-based attacks to extract the key. The ideal solution is to use Bitlocker with a PIN, right?
2
-
Yes, TPM + PIN helps: en.wikipedia.org/wiki/BitLocker#Security_concerns– HTKLeeCommented Jun 20, 2016 at 17:39
-
Note that DMA-capable ports should be disabled when using BitLocker, if at all possible. I've read some discussion of Windows trying to hide the key from DMA devices somehow, but barring a clear indication that this is a reliable measure, disabling devices (for example, in the BIOS/EFI) should work. Obviously, make sure an attacker can't just re-enable them (for example, if this trip BitLocker to demand the recovery password, that should be OK). Not a perfect protection against physical access, because internal DMA can't be prevented, but it may help in some cases.– CBHackingCommented Jun 20, 2016 at 19:47
Add a comment
|
2 Answers
As with any security measure, this reduces the risk, it doesn't eliminate it.
With no TPM, an attacker with physical access can just grab the disk, walk away and read the data at their leisure. If the disk is encrypted with a key in a TPM, the attacker needs to walk away with the whole computer (or at least pull out the RAM and store it safely, to try a RAM remanence attack which isn't fully reliable).
This makes no difference if the attacker has uncontrolled physical access, but it makes a difference if the attacker has limited access, e.g. they're walking around in an office environment or in a coffeeshop and are observed. In such circumstances, it can be very easy to grab a removable drive, it takes less than a minute with a screwdriver to extract a hard disk, whereas extracting RAM tends to require a bit more time and walking away with the whole PC is less discreet.
If the attacker has full physical access, you've lost anyway, though a tamper-resistant TPM plus a PIN to unlock the key can make things hard for the attacker if the machine is powered down before they reach it. Basically, whoever has physical access to the computer owns the computer — but that's only true for unfettered physical access, not in more restricted scenarios. In some scenarios, partial protection is useful.
Use of a TPM-based key should be combined with secure boot, refusing to unlock the drive if not booting the pristine operating system from that drive, so that someone walking past can't just reboot onto their USB stick. It should also be combined with memory wiping at boot time (at least if the last power cycle was not ended cleanly) to prevent cold boot attacks.
answered Jun 20, 2016 at 17:25
Gilles 'SO- stop being evil'Gilles 'SO- stop being evil'
52.4k14 gold badges126 silver badges184 bronze badges
-
1I have one more question. If an attacker replaces the hard drive in my computer (which has TPM+PIN based bitlocker encryption and secure boot it turned on), with a new one, what will be the challenges for attacker? This might be a stupid question but I am kind of confused. Is it easy to use my computer just by replacing the hard drive ?– entropyCommented Jun 21, 2016 at 20:07
-
1@entropy If the BIOS is locked and requires secure boot then to use your computer the attacker would need to replace or erase the hard drive, and reinitialize the TPM (which wipes all the keys and other data that it stores). Reinitializing the TPM is possible if you have physical access — after all you presumably want to keep using it if the hard disk fails. Commented Jun 21, 2016 at 20:37
-
Just to be sure, the secure boot you are talking about is the Secure boot option in Group Policy Editor and not the UEFI secure boot right ? I have both enabled.– entropyCommented Jun 21, 2016 at 20:47
TPM protects you from an attacker removing your hard drive and mounting it in another computer, or booting to another OS on the same computer.
The pin protects you from an attacker logging into your computer directly.
-
Which PIN is it? I have a password to start my Windows session, is it enough? I'm thinking so as a thieft will be able to bot the computer but will be blocked at the Windows login screen, right? Commented Apr 8, 2018 at 12:44