Does it matter where I buy my TPM from? What are the downsides of buying a $15TPM over Ebay? Can a TPM be a Trojan horse that compromises my security?
1
-
1a TPM is an LPC peripheral. The messages it sends over the bus are parsed in the kernel and in tss library. It is very plausible that such code is not hardened against a malicious TPM, and a malicious TPM can get code execution and inject some shellcode. I 100% believe the NSA could hack you through a TPM you bought and they intercepted and replaced. But regular criminals? Unlikely.– Z.T.Mar 21, 2020 at 13:10
Add a comment
|
3 Answers
Can a TPM be a Trojan horse that compromises my security?
Yes, if they can modify the TPM firmware without TPM detecting it. (ZT and MemAllox already stated how malicious TPM can be used for code execution)
However, TPM chips are tampered proof from physical attacks and has a lockout/shutdown functionality if tampering is detected. So, it’s not easy to do so. Also, there are no known attacks like this as of now.
One thing that you need to ensure is whether your TPM is from trusted vendors like Infineon or STM or from the source that really create TPM chips as per TCG specification. For this you can use Endorsement Key certificates for verification. (Windows: EK verification, Linux: EK verification)
The TPM is a passive device. It will answer to your commands but it will not act on its own - at least if it is compliant to the specification (which obviously does not apply to malicious ones).
The TPM is connected via LPC or SPI. It cannot access your system memory per se. However, as pointed out by Z.T., a malicious TPM may exploit vulnerabilities in the kernel driver and/or the software stack used for communicating with the TPM. That means, code execution by a malicious TPM is plausible. IMHO, I think if you're not a high-value target, an attack is unlikely.
Fortunately, every manufacturer ships their TPM with an Endorsement Key (EK) and an EK certificate. This is an X.509 certificate guaranteeing that your TPM device is genuine. You might want to verify it before installing it to your security-critical machine.
Assuming your TPM is not malicious, it might be less secure. Of course, there is no indication of your device's protection level besides the price, certification (e.g. Common Criteria EAL) and security issues from the past.
What are the downsides of buying a $15TPM over Ebay?
You might just be purchasing a lower quality chip.
Because of analog variations in the manufacturing process of chips, some chips just don't function as well as others.
A big brand company might have a deal with the chip manufacturer where they get to reject all but the cream of the crop chips, leaving the manufacturer with the rejects.
The manufacturer might still sell the lesser-quality chips at a lower price.
I think this is a more likely scenario than malicious code being the reason for the cheap chip.
