Thin Client FDE Bypass: HP ThinPro, Dell ThinOS, IGEL OS 12

Summary of Key Findings: Thin Client Full-Disk Encryption Vulnerabilities Vulnerability Overview Core Issue: Severe flaws in the implementation of Full-Disk Encryption (FDE) across multiple vendors' thin clients, rendering the encryption ineffective. Root Cause: TPMs were not properly bypassed or key management was inadequate, allowing attackers to retrieve or bypass encryption protection through physical access or specific conditions (e.g., reboot, specific commands). Key Findings: - HP ThinPro 8.x: The LUKS key is written into PCRs, but the GRUB binary file is unsigned; attackers can tamper with GRUB to bypass verification. - Dell ThinOS 9.x: The random key is stored in the TPM, but the unlock passphrase can be derived from hardware components such as the device serial number, CPUID, and MAC address. Additionally, when Secure Boot is disabled, attackers can mount the boot partition and modify the boot loader. - Dell ThinOS 10.x: The LUKS key is stored in the TPM, but the key is not bound to a PIN. Attackers can unlock it using the command. - IGEL OS 12: In TPM+PCR mode, the signed boot loader reads an unsigned, unverified configuration area. Attackers can modify this area to bypass verification. - IGEL OS 12: As a second line of defense, the unsigned file can be tampered with. Attackers can exploit it to open the boot loader and modify PCR values. Scope of Impact Affected Products: - HP ThinPro 8.x - Dell ThinOS 9.x / 10.x - IGEL OS 12 Affected Scenarios: - Physical access to the device (e.g., plugging/unplugging USB devices, modifying GRUB, tampering with configuration areas) - Execution of specific commands (e.g., ) - Reboots or specific operations (e.g., power cycling, rebooting) Risk Level: High (Medium), as physical access or specific conditions are required, but once these conditions are met, full-disk encryption can be bypassed. Remediation HP: The fix is still in the QA phase and has not yet been released. Dell: - ThinOS 9.x: Requires a firmware update or a modification of the key management logic to ensure keys are bound to the hardware. - ThinOS 10.x: Requires fixing the verification logic of the command to ensure the key is correctly bound to the PIN. IGEL: - OS 12: Requires signing and verifying the configuration area to ensure the boot loader only reads signed configurations. - Requires fixing signature verification for the file to prevent tampering of unsigned files. General Recommendations: - Enable Secure Boot and verify all boot components. - Ensure TPM keys are bound to hardware, avoiding key generation from derivable hardware components. - Perform signature verification on configuration areas and boot loaders to prevent tampering of unsigned files. POC / Exploitation Code Dell ThinOS 10.x: or (Note: Both commands are identical in the original text, which may be a typo; they should likely involve different parameters or scenarios.) IGEL OS 12: - Modify the unsigned configuration area to bypass signature verification. - Tamper with the file to modify PCR values. Additional Information Disclosure Timeline: February to April 2026, with a 90-day window period. CVE Status: As of the time of writing, vendors have not released CVEs; the author has applied for reserved CVEs but has not received them yet. Related Resources: - Dell ThinOS 10.x: Key is behind the door; the patch trusts an incorrect certificate. - HP ThinPro 8.x: TPM-sealed disk encryption is compromised by an unsigned file. - Dell ThinOS 9.x: TPM-sealed disk encryption is unlocked via the serial number. - IGEL OS 12: TPM+PCR disk encryption is compromised via the boot area. - IGEL OS 12: An unsigned file compromises GRUB.

Goal Reached Thanks to every supporter — we hit 100%!

Thin Client FDE Bypass: HP ThinPro, Dell ThinOS, IGEL OS 12