# 🔓 A $5 gadget opened BitLocker — the key crosses an open wire **URL:** \ **Category:** Tutorials & Methods\ **Tags:** hacking, tips-tricks, windows\ **Created:** [October 12, 2026, 8:11pm UTC](https://onehack.st/t/a-5-gadget-opened-bitlocker-the-key-crosses-an-open-wire/326415 "2026-10-12T20:11:44Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BCBC](https://onehack.st/user_avatar/onehack.st/bcbc/32/174133_2.png) [@BCBC](https://onehack.st/u/BCBC)\ **Post date:** [October 12, 2026, 8:11pm UTC](https://onehack.st/t/a-5-gadget-opened-bitlocker-the-key-crosses-an-open-wire/326415/1 "2026-10-12T20:11:45Z")
### 🔓 A $5 gadget opened BitLocker — the key crosses an open wire ![A board-level view: the TPM chip on the left, the CPU on the right, four copper traces between them, a glowing golden key travelling along the traces and a brass probe clip biting the wire — the key crosses an open wire, BitLocker is fine the bus is not, five dollars](https://onehack.st/uploads/default/original/3X/d/f/dfe221c5615db2c5177ae3d5646d3bbafa117974.jpeg) **Your disk is locked by the strongest thing Windows has. Two researchers opened one with a conference badge.** The encryption is not broken — BitLocker’s maths is fine. The flaw is the **wire the key crosses** on its way out of the chip, and no Windows update can fix a wire. **🎯 Why it matters:** on a machine with a **separate TPM chip** , the key that unlocks your disk travels **in the clear** between two components, and a cheap probe can read it during boot. **✨ What makes it unique:** most BitLocker stories are about a password or a software bug. This one is about the **hardware layout** underneath the operating system. **❤ Why you should care:** it changes what you do with a laptop that leaves the house. ### 🔑 The trick in one picture ```auto power on | [TPM chip] --------> CPU | key crosses | in the clear [your disk] ``` The **Volume Master Key** — the key that unlocks your drive — leaves the TPM and heads for the CPU so the machine can start. On a **discrete TPM** , a separate chip soldered to the board, that trip happens over an **SPI bus** that is **unencrypted** , and slow enough to read. Clip a logic analyser to those traces, power the machine on, capture the boot. The key is in your hand, and the drive opens. ### 🧪 None of this is brand new — it keeps getting cheaper - **2019 · Pulse Security** — sniffable in the default configuration, from TPM 1.2 or 2.0, with a dirt-cheap FPGA. Their advice still stands: **add pre-boot authentication**. - **2020 · Reversec Labs** — a full write-up plus a released **Saleae Logic 2 toolkit** that decodes TPM traffic and pulls the key out. - **2024 · Post-Cyber Labs** — pulled it off **with BitLocker PIN enabled** ; their test machine was an HP EliteBook 840 G6. - **2024 · Dell’s own advisory** — confirms interception on the CPU-to-discrete-TPM bus on certain models, and notes **Dell commercial PCs use a discrete TPM**. ### 🖥 Which machines are exposed - **Discrete TPM** — a separate chip on the board: the exposed design. Common in business laptops and desktops. - **Firmware TPM** — built into the CPU: a different case, where the attack needed fault injection rather than a probe on a wire. - **Physical access is required.** This is a stolen-laptop attack, not a remote one. ### 🛡 What to do about it **1 · Turn on the pre-boot PIN.** The oldest advice, still the first line of defence — the machine waits for you before it boots. **2 · Know the caveat.** The 2024 work read the PIN from the same bus. A PIN raises the bar; physical security carries the rest. **3 · Treat a lost laptop as lost.** Encryption protects data at rest, not a determined person holding the machine. ### 🔗 Go deeper - **[The talk](https://www.youtube.com/watch?v=U-wuOeI9vQg)** — Allen & Dale Cook at CypherCon 9.0 - **[The session page](https://cyphercon.com/speaker/bypassing-bitlocker-full-disk-decryption-for-less-than-5/)** — the abstract in the speakers’ own words - **[Reversec’s SPI toolkit](https://labs.reversec.com/tools/bitlocker-spi-toolkit)** — the VMK extractor for the SPI bus - **[Sniff, there leaks my BitLocker key](https://labs.reversec.com/posts/2020/12/sniff-there-leaks-my-bitlocker-key)** — the 2020 research - **[Pulse Security](https://pulsesecurity.co.nz/articles/TPM-sniffing)** — the 2019 original and its mitigation section - **[SCRT: TPM sniffing with a PIN enabled](https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/)** — the 2024 escalation - **[Dell’s response](https://www.dell.com/support/kbdoc/en-us/000222428/dell-response-to-tpm-interposer-bitlocker-research)** — the vendor’s own advisory **⚙ The takeaway:** hardware choices protect you as much as software ones. BitLocker is only as strong as the wire it trusts.