TPM-FAIL: TPM meets Timing and Lattice Attacks

• Found on Nov 12 2019 from http://tpm.fail/tpmfail.pdf
• Original PDF content

Comments

Nov 12 2019 mjos\dwez

This is pretty cool and important stuff on full working timing attacks on real-life TPMs; paper http://tpm.fail/tpmfail.pdf Intel TPM chips: CVE-2019-11090, ST's TPM chips: CVE-2019-16863. In this case a vulnerability website is entirely appropriate: http://tpm.fail/ https://t.co/851Bt3A6JA

Nov 13 2019 Ian Coldwater ⎈

Oh shit. This is a big deal. And it can be done over the wire!

Nov 13 2019 Jann Horn

timing attack against a TPM, and since that's not hard enough already, they do it over a network connection, too?

Nov 13 2019 Daniel Cuthbert

Having spent the last month knee-deep in TPMs, this is just something else. Super solid research here, wow

Nov 13 2019 Michal Stanek

Uh oh.. a new, practical, remote (!) timing attack on discrete and firmware TPMs. Extracts private keys in just a few hours. Infineon and Nuvoton chips apparently not affected.

Nov 13 2019 friendly neighborhood dog mom

Honestly, it's far beyond time to stop fucking trusting Intel for *literally anything*. Every tech company making similar products has vulnerabilities, but Intel's built up a *fuck* of a list at this point compared to everyone else.

Content