Secure Boot and TPM

Introduction

Secure Boot and TPM are hardware security technologies that protect the system boot process against malicious modifications.

Secure Boot

Definition

Secure Boot is a UEFI security feature that prevents the loading of unsigned software during boot.

Operation

1. UEFI starts
2. Bootloader signature verification
3. Bootloader verifies kernel signature
4. Kernel verifies drivers
5. Complete boot only if everything is signed

Key Database

Base	Content	Role
PK (Platform Key)	Manufacturer's key	Full control
KEK (Key Exchange Key)	Microsoft/manufacturer keys	DB updates
db (Signature Database)	Authorized signatures	Whitelist
dbx (Forbidden Signatures)	Revoked signatures	Blacklist

Status Verification

PowerShell:

# Check if Secure Boot is active
Confirm-SecureBootUEFI

# More details
Get-SecureBootPolicy -ErrorAction SilentlyContinue

Via msinfo32:

Win+R > msinfo32 > Secure Boot State

Security Implications

Advantages:

• Prevents bootkits and boot rootkits
• Protects against bootloader modifications
• Integrity of the boot chain

Limitations:

• Can be disabled in BIOS
• Some advanced malware can bypass it
• Does not protect against post-boot attacks

---

TPM (Trusted Platform Module)

Definition

The TPM is a dedicated security chip that stores cryptographic keys and measures system integrity.

Versions

Version	Features
TPM 1.2	SHA-1, RSA, legacy
TPM 2.0	SHA-256, modern algorithms, required for Windows 11

Main Features

1. Key Storage: Keys that never leave the TPM
2. Integrity Measurements: PCR (Platform Configuration Registers)
3. Attestation: Prove system state
4. Sealing: Bind data to a specific system state

PCR (Platform Configuration Registers)

PCRs store integrity measurements:

PCR	Content
0-3	UEFI Firmware
4	Bootloader (MBR/UEFI)
5	GPT Configuration
6	Platform events
7	Secure Boot
8-15	Operating system

TPM Verification

PowerShell:

# Check for TPM presence
Get-Tpm

# Full details
Get-TpmEndorsementKeyInfo
Get-TpmSupportedFeature

Via tpm.msc:

Win+R > tpm.msc

Via Device Manager:

devmgmt.msc > Security Devices > Trusted Platform Module

---

BitLocker and TPM

Integration

BitLocker uses the TPM to:

• Store encryption keys
• Seal keys to system state
• Automatically unlock at boot

BitLocker Modes

Mode	TPM	PIN	USB Key	Security
TPM only	Yes	No	No	Basic
TPM + PIN	Yes	Yes	No	High
TPM + USB	Yes	No	Yes	High
TPM + PIN + USB	Yes	Yes	Yes	Maximum

BitLocker Verification

# BitLocker status
Get-BitLockerVolume

# Details
manage-bde -status C:

---

Attacks and Bypasses

Cold Boot Attack

Principle: RAM retains data for a few seconds after power off.

Protection: TPM with integrity measurements, RAM encryption.

Evil Maid Attack

Principle: Physical modification of the system while the user is absent.

Protection: TPM detects changes via PCRs.

DMA Attack

Principle: Direct memory access via external ports (Thunderbolt, FireWire).

Protection: Kernel DMA Protection, disable unused ports.

TPM Sniffing

Principle: Intercept communications between CPU and TPM on the LPC bus.

Protection: fTPM (firmware TPM integrated into the CPU).

---

Recommended Configuration

Security Checklist

# Boot security verification script
Write-Host "=== BOOT SECURITY VERIFICATION ===" -ForegroundColor Cyan

# 1. Secure Boot
try {
    $sb = Confirm-SecureBootUEFI
    if ($sb) {
        Write-Host "[OK] Secure Boot: Active" -ForegroundColor Green
    } else {
        Write-Host "[!] Secure Boot: Inactive" -ForegroundColor Red
    }
} catch {
    Write-Host "[?] Secure Boot: Unable to verify" -ForegroundColor Yellow
}

# 2. TPM
$tpm = Get-Tpm
if ($tpm.TpmPresent) {
    Write-Host "[OK] TPM Present: Yes" -ForegroundColor Green
    Write-Host "     Version: $($tpm.ManufacturerVersion)"
    if ($tpm.TpmReady) {
        Write-Host "[OK] TPM Ready: Yes" -ForegroundColor Green
    } else {
        Write-Host "[!] TPM Ready: No" -ForegroundColor Yellow
    }
} else {
    Write-Host "[!] TPM: Not detected" -ForegroundColor Red
}

# 3. BitLocker
$bl = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue
if ($bl) {
    if ($bl.ProtectionStatus -eq "On") {
        Write-Host "[OK] BitLocker C: Active" -ForegroundColor Green
    } else {
        Write-Host "[!] BitLocker C: Inactive" -ForegroundColor Yellow
    }
}

# 4. UEFI Mode
$firmware = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -ErrorAction SilentlyContinue
if ($firmware.UEFISecureBootEnabled -eq 1) {
    Write-Host "[OK] UEFI Mode with Secure Boot" -ForegroundColor Green
} else {
    Write-Host "[?] BIOS Mode or Secure Boot disabled" -ForegroundColor Yellow
}

Recommendations

1. Enable Secure Boot in BIOS/UEFI
2. Enable TPM and configure it
3. Use BitLocker with TPM + PIN
4. Regularly update UEFI firmware
5. Protect physical access to the machine

---

Exercises

1. Check if Secure Boot is active on your VM
2. Check the presence and status of the TPM
3. Identify security settings in your machine's BIOS/UEFI
4. Explain how TPM and Secure Boot work together

---

References

• Microsoft: Secure Boot
• Microsoft: TPM
• BitLocker Overview