TPM SNIFFING

Retrieving Bitlocker keys from a dTPM using SPI, I2C or LPC communications requires an understanding of the specific protocol supported by a dTPM chip, as well as the device's make and model. Proper documentation and research are essential for successful key retrieval. This repo is to collaborate all the awesome resources and information hopefully into one place!

NOTE: I'm 100% sure that there is alot of blogs/data missing here, but please if you know of any and want to contribute, please DO a PR!

Introduction

Trusted Platform Module (TPM) is a hardware-based security chip that is often used to store encryption keys securely, including Bitlocker keys used for full disk encryption in Windows environments. Retrieving these keys from a dTPM can be achieved through various communication channels, although the specific method may vary depending on the device's make and model.

Table: TPM Communication Methods

Make	Model	Model Number	TPM	Chipset	Protocol	Location	Debug Headers	Blog/Research	Extractable
Lenovo	Thinkpad	L440	1.2	P24JPVSP	LPC	Under Keyboard	Yes	Blog	Yes
Lenovo	X1 Carbon	Gen 11	2.0	ST33TPHF2XSPI	SPI	Under Motherboard	Test Pads	@NoobieDog	Yes
Lenovo	T460	BT462 NM-A581 rev.2	1.2	SLB9670VQ1.2	SPI	Under Motherboard	Extractable via BIOS Chip	@zaphoxx	Yes
Dell	Lattitude	E7450	1.2	AT97SC3205	SPI	Under Motherboard	No	@SecurityJon	Yes
Dell	Lattitude	E5470	2.0	NPCT650JAOYX	SPI	Motherboard	Yes	Blog	Yes
Dell	Lattitude	E5450	1.2	AT97SC3205	SPI	Motherboard	Yes	Blog	Yes
Microsoft	Surface Pro 3		2.0	SLB9665TT2.0	LPC	Under Battery	No	Blog	Yes
Asus	TPM-M R2.0		2.0	SLB9665TT2.0	LPC	-	Yes	Video	Yes
HP	Elite	640 g9	2.0	SLB9670	SPIC	-	Yes	-	Yes

Research

For further information and detailed instructions, refer to the provided blog posts and research documents.

Stealing the Bitlocker key from a TPM

TPM Hate Him! TPM Attacks

Microsoft bitLocker bypasses are practical

A Deep Dive into TPM-based BitLocker Drive Encryption

TPM Sniffing

Extracting BitLocker keys from a TPM

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

From Stolen Laptop to Inside the Company Network

Sniffing Bitlocker Keys on the SPI Bus

TPM 2.0: Extracting Bitlocker keys through SPI

Understanding TPM Sniffing Attacks

Breaking Bitlocker: Bypassing the Windows Disk Encryption

TPM Sniffing Attacks Against Non-Bitlocker Targets

Sniff, there leaks my BitLocker key

Bitlocker Attacks

BitCracker: BitLocker meets GPUs

TPM Fail

TPM Vulnerabilties

AMD TPM Exploit

Tools

A list of awesome tools for sniffing TPM data are listed below.

bitlocker-spi-toolkit

Pico-TPMSniffer

LPCClocklessAnalyzer

PICO TPM SNIFFER - SPI

libsigrokdecoder_spi-tpm

IceStick LPC TPM Snigger

Trainings

Hands-on-security Bitlocker/TPM Hardware training Course

Mitigations

The only mitigation for this attack is to enable BitLocker with a PIN OR security key which is adds "Preboot Authentication”. The sniffable key isnt released until after the correct pin is entered. Enterprises rarely use the PIN or security key because it’s inconvenient for users, they need to enter the unlock PIN then their normal user password.

Preboot Authentication