TPM stands for Trusted Platform Module and in the early days TPMs were separate chips added to a motherboard where a CPU would store and manage sensitive information such as cryptographic keys.

They were used to ensure hardware integrity during the boot-up process or to attest various cryptographic operations, such as handling digital certificates, ensuring HTTPS connections on servers, or verifying authentication-related processes.

With the rise of smart devices, there was no room for a separate TPM chipset on all devices and they became software in firmware-based known as fTPMs.

Boffins at Worcester Polytechnic Institute (USA), the University of Lübeck (Germany), and the University of California, San Diego (USA) have disclosed two vulnerabilities that impact two very widely used TPM solutions.

The first vulnerability is CVE-2019-11090 and impacts Intel's Platform Trust Technology (PTT).

Intel PTT is Intel's fTPM software-based TPM solution. It is widely used on servers, desktops, and laptops, being supported on all Intel CPUs released since 2013, starting with the Haswell generation.

The second is CVE-2019-16863 and impacts the ST33 TPM chip made by STMicroelectronics.

But the novelty and danger factor surrounding TPM-FAIL rely on the fact that this attack is also fully weaponisable in a real-world scenario.

Similar attacks on TPMs usually recover partial keys or take too long to execute. TPM-FAIL does not.

"A local adversary can recover the ECDSA key from Intel fTPM in 4-20 minutes depending on the access level. We even show that these attacks can be performed remotely on fast networks, by recovering the authentication key of a virtual private network (VPN) server in five hours."

Performing a five hour long attack on a remote VPN server isn't as hard as it sounds. Per the research team, the attack involves initiating around 45,000 authentication handshakes against a remote VPN server and recording the responses.