News for hackers. Stuff that matters.

A comment on Cheating communities have realized that they are unable to spoof TPM hardware ID. Parent comment

Re:Cheating communities have realized that they are unable t... by metalcrow on Saturday June 01, 2024 @02:36PM (#40548024)
In that case, maybe you could do a sort of replay attack? Take a TPM, record a million or so valid states and their signature, and replay those in order every boot? Assuming the TPM is deterministic on startup and you record enough states that you don't have to loop them before reboot, you would have, in effect, a swappable TPM.

Of course, if you get banned then you need to record a new TPM and use that, and that may be difficult.

[ Parent | on HN ]
Re:Cheating communities have realized that they are unable t... by richbell on Saturday June 01, 2024 @04:17PM (#40548760)
My understanding is that replay attacks are possible with a TPM, if the consuming logic is flawed.

IIRC Microsoft's original implementation of signing Primary Refresh Tokens with TPM was flawed in this way.

[ Parent | on HN ]
Re:Cheating communities have realized that they are unable t... by utensil4778 on Saturday June 01, 2024 @03:16PM (#40548333)
A nonce is a token specifically meant to prevent replay attacks. There's no sane reason to assume TPM is deterministic, as that would defeat the purpose of all the security.
[ Parent | on HN ]
Re:Cheating communities have realized that they are unable t... by metalcrow on Saturday June 01, 2024 @03:44PM (#40548514)
You're right, i somehow skipped over that in reading. And you would want a TPM to be deterministic, after all one major use of the TPM is validating the hardware and boot state is unchanged. Is the state except of the nonce deterministic?
[ Parent | on HN ]