TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Older PCs that use a discrete TPM may expose BitLocker decryption keys to an attacker with physical access, because TPM-to-CPU traffic can travel over an unencrypted bus. The vulnerability is not an internet attack; a pre-boot BitLocker PIN can stop the TPM from releasing the key automatically.
Older computers that rely on a discrete Trusted Platform Module (TPM) may expose their BitLocker decryption keys to an attacker who can physically access the machine, according to a security report published October 17. The attack uses hardware to read unencrypted communication between the TPM and CPU; requiring a BitLocker pre-boot PIN can prevent the key from being released automatically.
A TPM checks whether key parts of the system’s boot process have changed before making cryptographic keys available. BitLocker can use that check to protect an encrypted drive against someone trying to start the computer from another operating system. In the default TPM-only setup, however, the user does not enter another credential at startup if the boot state passes the TPM’s checks.
On systems with a discrete TPM, the chip sends key material to the processor over a bus such as LPC or SPI. The report says that traffic is not encrypted, creating an opportunity for an attacker with physical access to monitor it using equipment such as a logic analyzer or FPGA board. The attacker may probe the TPM directly; using an unused motherboard debug header is not required.
The article cites a 2019 demonstration by Pulse Security, which used a low-cost FPGA board to show the technique. It also says similar attacks have been demonstrated on laptops from Dell, Lenovo and Microsoft. The reported method requires access to the hardware and is not an attack that can be carried out remotely over the internet.
Your Motherboard’s Old Debug Header Is Still Listening
On some older PCs, a discrete TPM sends BitLocker key material to the processor over an unencrypted motherboard bus. Physical access can make that traffic readable. A pre-boot PIN changes what the TPM releases.
This is a hands-on hardware attack—not an internet attack.
When automatic key release meets an open bus
A TPM checks whether key parts of the boot process have changed before making cryptographic keys available. BitLocker can use that check to protect an encrypted drive. In a TPM-only setup, a passing boot check can release the key without another startup credential.
A separate chip
Older systems may use a TPM module connected to the motherboard. Key material travels between that chip and the processor over a bus such as LPC or SPI.
Traffic can be read
The reported technique uses equipment such as a logic analyzer or FPGA board to monitor unencrypted communication while the computer starts.
Not a remote exploit
The method requires access to the machine and its hardware. The report does not describe an attack that can be carried out over the internet.
A pre-boot PIN adds a gate before decryption
With TPM-only startup, the computer can request the drive key automatically after the TPM’s boot checks pass. Requiring a PIN adds a credential the attacker cannot obtain from bus monitoring alone.
USB startup key: It can add another requirement, but the key must be available every time the PC starts. A PIN is a practical additional barrier; neither option guarantees protection against every physical or software attack.
Check the TPM before changing assumptions
Newer processors commonly support a firmware TPM (fTPM), implemented in processor firmware rather than in a separate motherboard module. The source cites Intel 8th-generation and AMD Ryzen 2000-series processors as examples with broadly available TPM 2.0 support.
Open tpm.msc
Open the Windows Run dialog, enter tpm.msc, and review the manufacturer details. Intel, AMD, or Microsoft may indicate firmware TPM; Infineon, Nuvoton, or STMicroelectronics may indicate a discrete module.
Treat names as clues
Hardware and firmware configurations vary. Check your specific PC’s documentation and BitLocker controls to confirm the TPM type and whether startup uses TPM-only protection.
The October 17 article revisits a technique demonstrated by Pulse Security in 2019. It does not report a newly discovered vulnerability, a new patch, a complete list of affected models, or a new independent test. The precise exposure varies by device and configuration.
Trace the risk from hardware to a safer setting
The useful next step is device-specific: identify the TPM, check the BitLocker startup mode, then review whether an additional startup credential is available and appropriate.
Find the TPM details
Use tpm.msc, then consult the computer documentation to determine whether the system uses a discrete TPM or firmware TPM.
Check BitLocker startup
Review whether the drive relies on TPM-only startup. Windows edition and device configuration can affect available controls and exact steps.
Consider PIN or USB key
Where supported and suitable, require a pre-boot PIN or startup key so automatic TPM release alone is not enough to unlock the drive.
Key questions
Can this attack be carried out over the internet?
No. The reported method requires physical access to the computer and access to its hardware.
Does a pre-boot PIN help?
The report says a PIN prevents automatic key release, so bus sniffing alone is insufficient. It does not claim protection against every possible attack.
Is this a newly discovered vulnerability?
No new discovery is reported. Pulse Security demonstrated TPM bus sniffing in 2019; the October 2026 article revisits the risk.
Which computers are affected?
The source gives no complete model or firmware list. Check your own TPM, BitLocker settings, and device documentation.
How a Pre-Boot PIN Changes the Risk
The issue matters because drive encryption protects data only if the decryption key remains inaccessible to an unauthorized person. A stolen or unattended laptop can give an attacker the physical access this method requires, even when the computer’s drive is encrypted and the owner has not shared a login password. The report describes the attack as requiring only minutes once an attacker has access and prepared equipment; the precise time and requirements may vary by device.
Setting BitLocker to require a pre-boot PIN adds a step before the TPM releases the key. According to the report, this prevents an attacker from obtaining the key through bus monitoring alone, because the machine will not automatically complete the same key-release process without the PIN. A startup key on a USB drive can add another requirement, though it also adds friction every time the owner starts the PC.
The protection is not a guarantee against every physical or software attack. The source notes that firmware TPMs also have potential attack avenues, including voltage-injection and software-based techniques. The practical takeaway is narrower: TPM-only BitLocker on an older system may not provide the same protection against physical key interception as a setup that requires an additional startup credential.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 7 Crypto Hardware Wallet
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Midnight
As an affiliate, we earn on qualifying purchases.
Discrete TPMs and Older PCs
Newer processors commonly support a firmware TPM (fTPM), which implements TPM functions in processor firmware rather than in a separate module connected to the motherboard. The source identifies Intel 8th-generation processors and AMD Ryzen 2000-series processors as examples from which TPM 2.0 support is broadly available. Older computers may instead depend on a discrete TPM fitted to a motherboard TPM header.
Users can check TPM details by opening the Windows Run dialog, entering tpm.msc and reviewing the manufacturer information. The source says manufacturer names such as Intel, AMD or Microsoft indicate firmware TPM, while names including Infineon, Nuvoton or STMicroelectronics can indicate a discrete module. Hardware and firmware configurations differ, so the displayed name should be treated as a clue rather than a substitute for checking the specific PC’s documentation.
The attack described is not new: Pulse Security demonstrated bus sniffing in 2019. The October 17 article revisits the risk for owners of older hardware and points to a configuration change available through BitLocker. It does not report a newly discovered vulnerability or a newly released patch from a hardware or software maker.
Which Devices Remain Exposed
The source does not provide a complete list of affected computer models, discrete TPM modules, firmware versions or operating-system configurations. It also does not say how many computers remain exposed, or whether the described bus-sniffing method works identically across all systems that use a discrete TPM. Owners should check their own hardware and BitLocker settings rather than assume every older PC is vulnerable.
The report describes the bus traffic as unencrypted and cites prior demonstrations, but it does not present a new independent test or a vendor advisory issued on October 17. It is also unclear whether any manufacturer-specific firmware updates address the issue for particular devices. The attack’s physical-access requirement reduces its reach, but the likelihood of a real-world attempt is not quantified.
Check TPM and Startup Settings
Owners of older Windows PCs can check the TPM manufacturer in tpm.msc and review whether BitLocker uses TPM-only startup. Those with discrete TPM hardware can consult their device documentation and BitLocker controls about requiring a pre-boot PIN; availability and exact steps may vary by Windows edition and device configuration. A USB startup key is another option described in the source, with the trade-off that it must be available at each boot.
No new patch, vendor response or affected-device list was included in the source material. The next useful developments would be device-specific guidance from manufacturers and clearer confirmation of which configurations are affected. Until then, the report’s immediate advice is to avoid relying solely on automatic TPM key release where an additional startup credential is available and appropriate.
Key Questions
Can this attack be carried out over the internet?
No. The reported method requires physical access to the computer and access to its hardware. It is not described as a remote internet attack.
How can I check whether my PC uses a discrete TPM?
Open the Windows Run dialog, type tpm.msc and check the manufacturer details. The source says Intel, AMD or Microsoft may indicate firmware TPM, while names such as Infineon, Nuvoton or STMicroelectronics may indicate a discrete module. Check your computer’s documentation for confirmation.
Does a BitLocker pre-boot PIN help?
The report says a pre-boot PIN prevents the TPM from releasing the key automatically, making bus sniffing alone insufficient to obtain it. The source does not claim that a PIN protects against every possible attack.
Is this a newly discovered vulnerability?
No new vulnerability discovery is reported. Pulse Security demonstrated the bus-sniffing technique in 2019; the October 17, 2026 article revisits the risk and the available BitLocker configuration options.
Source: XDA Developers
