TL;DR

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Older computers that rely on a discrete TPM may expose BitLocker decryption keys over an unencrypted communication bus, according to the source report. The attack requires physical access; a pre-boot PIN can prevent the TPM from releasing the key automatically. The scope of affected systems and available manufacturer patches are not established in the source material.

A report published Oct. 17, 2026, warns that some older PCs using a discrete Trusted Platform Module (TPM) can expose BitLocker decryption keys to an attacker with physical access, because key traffic between the TPM and processor may travel over an unencrypted bus. The issue is not a remote internet attack, and a pre-boot PIN can stop the drive key from being released automatically.

The security concern applies to systems where a separate TPM chip is installed on the motherboard, rather than a firmware TPM integrated into the processor. The report says the discrete chip may communicate with the CPU through buses such as LPC or SPI, and that traffic can be intercepted if an attacker can reach the hardware. A motherboard debug header may offer a convenient connection point, but the report says an attacker could also probe the TPM itself; the header is not required.

In a typical TPM-only BitLocker setup, the TPM checks boot measurements and releases the key if the system appears unchanged. According to the report, an attacker who captures the unencrypted exchange can use the key to decrypt the drive on another system. This bypasses the protection users may expect from drive encryption when a device is stolen or left unattended, but it requires physical access and suitable equipment.

The report cites a 2019 demonstration by Pulse Security, which used a $40 FPGA board to capture key material. It also says attacks have been shown on laptops from Dell, Lenovo and Microsoft, though it does not provide model numbers, affected firmware versions or a complete list of vulnerable devices. The suggested mitigation for systems without firmware TPM support is to configure BitLocker to require a startup PIN before the TPM releases the key.

How a Stolen Laptop Could Be Exposed

The issue matters most when an older encrypted computer leaves its owner’s control. BitLocker encryption can protect data if a drive is removed, but the described attack targets the key exchange while the TPM is authorizing a normal boot. A stolen laptop may give an attacker the physical access needed to inspect its motherboard, turning an unattended device into a more practical target than a remotely reachable computer.

That risk should not be overstated: the source describes a hands-on attack, not a way to break BitLocker over a network. Still, many users rely on the default configuration, where the TPM releases the key without asking for a separate startup credential. Requiring a PIN adds a factor the attacker cannot obtain merely by monitoring the bus. The trade-off is added friction: the owner must enter the PIN during startup.

The report also cautions that firmware TPM is not invulnerable to every hardware or software attack. Its stated comparison is narrower: a processor-based firmware TPM avoids the same exposed, unencrypted discrete-chip bus pathway. Users should treat the mitigation as reducing this particular risk, not as a guarantee against all attacks.

Discrete and Firmware TPM Differences

A TPM helps protect encryption keys by checking whether key parts of the boot process, including firmware and bootloader measurements, match expected values. If they do, it can release a key used by software such as BitLocker. The distinction in this report is where the TPM runs: a discrete TPM (dTPM) is a separate motherboard chip, while a firmware TPM (fTPM) runs through platform firmware on supported processors.

The source says Intel 8th-generation and AMD Ryzen 2000-series processors and newer broadly support TPM 2.0 through firmware, while older systems may depend on a separate chip. Those are broad generational guidelines, not a definitive compatibility list for every PC. The report suggests checking TPM details through Windows’ tpm.msc utility: Intel, AMD or Microsoft may indicate firmware TPM, while names such as Infineon, Nuvoton or STMicroelectronics may indicate a discrete device. The result should be checked against the computer’s documentation where possible.

The concern is not newly discovered in the report. It points to Pulse Security’s 2019 demonstration and frames the exposure as a continuing risk for older hardware that remains in use. The material does not identify a new patch release or a recent incident prompting the warning.

“A pre-boot PIN prevents the TPM from releasing the master key without that additional authentication.”

— The XDA Developers report

Which Computers Remain at Risk

The source does not provide a complete list of affected models, motherboard revisions or TPM firmware versions, nor does it say whether particular manufacturers issued patches. It names Dell, Lenovo and Microsoft laptops as examples of systems on which researchers have demonstrated the attack, but offers no model-level detail or current test results. It is therefore not possible from the source alone to determine whether a specific computer is exposed.

The precise scope also depends on configuration and hardware access. The report describes unencrypted key traffic in discrete-TPM systems and says the attacker needs physical access, but does not establish how quickly every device can be opened or attacked. It does not report a confirmed campaign or estimate how often the technique has been used. Whether a device uses a discrete TPM should be verified using its system information and manufacturer documentation.

Check TPM Settings and Startup Protection

Owners of older PCs can first check the TPM manufacturer details in Windows using tpm.msc, then confirm the result with their device documentation. If the machine uses a discrete TPM and BitLocker is set to TPM-only protection, the report recommends configuring a pre-boot PIN. Some configurations can also require a startup key stored on a USB drive, though that adds another step to each boot.

Users should confirm that recovery keys are available before changing BitLocker settings, since startup configuration changes can affect access to an encrypted drive. The source does not identify a vendor patch or announce a coordinated fix. Further clarity would require model-specific guidance from PC makers and TPM suppliers, along with updated testing of affected systems.

Key Questions

Does this attack work remotely?

No. The report describes a physical-access attack involving hardware probes attached to a computer’s TPM bus or chip. It does not describe an internet-based method.

Are all computers with BitLocker vulnerable?

No such conclusion is supported by the source. The described risk concerns some systems using a discrete TPM with exposed, unencrypted key traffic. The report does not provide a complete list of affected devices.

How can I check whether my PC uses a discrete TPM?

The report recommends opening Windows’ tpm.msc utility and checking the manufacturer field. It says names including Infineon, Nuvoton or STMicroelectronics may indicate a discrete TPM, while Intel, AMD or Microsoft may indicate firmware TPM. Check your computer maker’s documentation to confirm.

What is the recommended mitigation?

For a system without firmware TPM support, the report recommends requiring a BitLocker startup PIN so the TPM does not release the key automatically. A startup key on a USB drive may add another requirement, but also adds inconvenience.

Has a new patch been released?

The source does not identify a new patch or say that manufacturers have issued model-specific fixes. It describes the risk as lingering and points to a demonstration from 2019.

Source: XDA Developers