The Trusted Platform Module (TPM), developed by the Trusted Computing Group (TCG), is a mandatory security component in any computer running Windows 11. It stores sensitive information such as encryption keys in a separate, secure chip, passing it to the CPU as required.
However, there’s a problem. If an attacker can get physical access to the device, they can use hardware costing less than $20, running readily available software, to grab those encryption keys as they are sent to the CPU, allowing data on the system to be readily decrypted by the attacker and stolen.
At its Imagine event this week, HP announced a product that it says prevents this kind of attack without the need to make changes to device encryption software such as BitLocker. TPM Guard is a combination of hardware and firmware that creates an authenticated and encrypted tunnel between the TPM and the CPU to protect the communication between them, said Ian Pratt, HP’s vice president of security and commercial systems. The TPM is cryptographically bound to the host processor so if the chip is removed from the system, the TPM will cease to function.
“This isn’t just about espionage agents sneaking into hotel rooms of executives while they’re out at dinner,” he said during a media briefing. “Many laptops get stolen every day, and if a laptop is owned by an enterprise, there’s potentially a lot more value to the data it contains than the resale value of the device itself. And hence, opportunity for that device to work its way through the black market to a crime group that is capable of extracting the data and monetizing it, perhaps using the credentials it contains to gain access to enterprise systems or threatening to leak customer data.”
Most companies today rely on BitLocker to encrypt that data, but the TPM issue can negate that protection, putting organizations at risk.
TPM can prevent a whole class of bus interception and interposition attacks, Pratt said.
HP wants the technology behind it to become an industry standard, and has already submitted a proposal to the TCG, he said.
Starting in July, TPM Guard will be available as a firmware update at no additional charge on “selected” HP G2 commercial PCs, and will be built in to supported PCs in the future.
Structurally significant
“HP TPM Guard is arguably the most structurally significant announcement [at HP Imagine] for enterprise, government, and high-compliance customers,” said Anurag Agrawal, chief global analyst at Techaisle. “From an architectural standpoint, it closes a massive physical edge loophole.”
It’s “a brilliant maneuver” against Microsoft’s Pluton architecture, Agrawal said, noting that Pluton eliminates the bus by putting security directly on the CPU die, while TPM Guard gives highly regulated customers the physical security of Pluton without forcing them to abandon their preferred TCG-certified discrete TPMs.
HP’s proposal of TPM Guard to the Trusted Computing Group (TCG) as a new industry standard “creates immediate security debt for HP’s rivals,” he said.
“By positioning TPM Guard as the first and only solution to this physical bus attack, HP is implicitly stating that the existing ‘secure’ fleets from competitors like Dell and Lenovo carry a known, exploitable vulnerability, giving HP and its channel partners a highly aggressive wedge issue to force early device refresh cycles,” he said.
TPM hasn’t been significantly updated for some time, making HP’s TPM Guard all the more important, said Rob Enderle, principal analyst at Enderle Group. “In the face of rising threats, it is always important to reinvest in defense, and that is what they are doing here.”
No Responses