↓ Skip to main content

“I did find that you can sometimes exploit this issue if you mash the Enter key really fast yourself too, so a keyboard emulator isn’t necessarily required either.”

Michael Finchampulsesecurity.co.nz ↗

An Arduino pressing Enter every 10 milliseconds burns through the password retries on a TPM-unlocked Ubuntu 20.04 box. systemd gives up and drops to a root shell, and the attacker asks the TPM to unlock the disk. The fix is two kernel flags, rd.shell=0 and rd.emergency=reboot. Disk encryption that a fast finger defeats is a login prompt with extra steps.