Item

mjg59 · 2026-10-28T06:00:25.000Z

Yeah I'm actually not terribly worried about the server scenario, but having a way to get code exec in the firmware lets you defeat measured boot, which means this is a Bitlocker bypass in the default config.

reorder9695 · 2026-10-28T07:50:40.000Z

Would this mean any TPM based decryption keys could potentially be compromised in this kind of attack? E.g. when they're used for LUKS disk encryption.

mjg59 · 2026-10-28T08:02:00.000Z

Yup, if there's no passphrase involved.

rocqua · 2026-10-28T12:38:44.000Z

Even if there is a passphrase, this would likely allow for brute-forcing it.

mjg59 · 2026-10-28T15:30:54.000Z

No, you'll still have the TPM's dictionary attack lockout.