Physical attackers can exploit vulnerabilities in HP ThinPro’s TPM-backed disk encryption system by modifying unencrypted boot files, enabling extraction of LUKS keys for data protection This article explores thinpro disk encryption. . Researcher Darren McDonald revealed that this flaw affects ThinPro 8 and 9 deployments on HP thin clients, undermining the notion that a TPM seal alone secures removed or stolen drives from offline access attacks.
The operating system is stored on a LUKS2-encrypted btrfs partition, and the custom utility hptc-tpm-tool seals the disk key within the Trusted Platform Module during startup. During this process, an initramfs key script requests the TPM-released key and supplies it directly to cryptsetup, typically avoiding storing the secret on disk.
McDonald discovered that within the initramfs script, the unseal_key can be modified such that once the TPM releases the LUKS key, it writes a copy of the key to the unencrypted BOOT partition before proceeding with normal decryption. Despite high confidentiality and integrity impacts, attackers do not require credentials, administrative privileges, user interaction, specialized hardware, soldering, or firmware reverse engineering. Enabling Secure Boot and configuring a BIOS password adds friction to attackers but neither mitigation addresses the core weakness if TPM policy fails to validate kernel, initramfs, and other code handling key releases.
Organizations should treat ThinPro full-disk encryption as ineffective after losing physical control and securely destroy retired storage.
