Hacker News Reader

Yeah I'm actually not terribly worried about the server scenario, but having a way to get code exec in the firmware lets you defeat measured boot, which means this is a Bitlocker bypass in the default config.

View on HN

Would this mean any TPM based decryption keys could potentially be compromised in this kind of attack? E.g. when they're used for LUKS disk encryption.

Yup, if there's no passphrase involved.

Even if there is a passphrase, this would likely allow for brute-forcing it.

No, you'll still have the TPM's dictionary attack lockout.

I thought that was usually enforced in the OS, and that this was a big reason why you need secure boot. To ensure that you cannot boot an OS that will allow a brute force.

Certainly this was the case with the iPhone when the FBI asked apple to write some custom firmware for them.

Reply on news.ycombinator.com