Physical TPM Sniffing Attack Bypasses BitLocker PIN Protection

Researchers disclosed a hardware attack that can bypass Microsoft BitLocker protections by intercepting communications with the Trusted Platform Module (TPM) during the boot process. The technique, demonstrated by Guillaume Quéré, targets devices protected with BitLocker and a PIN by probing motherboard traces and using a logic analyzer to capture key material exchanged at startup, including an encrypted intermediate key that can be used to recover the Volume Master Key and decrypt the drive.

The attack requires physical access to the device and the ability to disassemble it, rather than any remote code execution or software exploit. Microsoft documents BitLocker as a data-at-rest protection feature for Windows, but the reported bypass highlights that its security can be undermined when attackers can access hardware signals directly. Reported mitigations focus on operational controls rather than a Windows patch, including strong physical security, secure storage of devices, and proper wiping or destruction of drives and systems at end of life.