The web is full of articles explaining how to bypass TPM 2.0 and Secure Boot in Windows 11, and we even have tools that automatically disable both requirements when creating an installation USB drive. However, part of Microsoft's job is to explain why it's necessary to use TPM 2.0 and Secure Boot in Windows 11. Its official Microsoft Mechanics channel published a 17-minute video in early October that explores both technologies in depth, and it's worth watching.

Why Is TPM 2.0 and Secure Boot Necessary in Windows 11?
TPM 2.0 and Secure Boot

The Other Side of the Coin

Microsoft's decision is controversial; nobody doubts that. From the instant division of its user base to the recommendation to buy new computers amid the semiconductor crisis, Windows 11 has shown that Redmond's tact and communication problems are still alive. But now that the new operating system is among us, Microsoft seeks to convey to its users the main reasons why it is necessary to use TPM 2.0 and Secure Boot in Windows 11... or rather, "recommended".

That brings us to a video published on Microsoft Mechanics, one of the company's official YouTube channels. The channel usually produces content aimed at IT professionals, however, this 17-minute video does a decent job of describing the direct benefits of these security technologies for a broader audience, and includes some attacks as a demonstration.

TPM 2.0 and Secure Boot in Windows 11, Explained by Microsoft

  • The first attack exploits the exposure of RDP to the web. First it locates the target with Shodan, then moves to Kali Linux, and finally uses Hydra to perform a brute-force attack using a database of basic passwords. The simulation takes a few seconds, but we know well that a brute-force attack can last for days, and it's very impractical to do it blindly. With full access, the attacker injects its payload.
  • The second attack is carried out directly on a device without virtualization-based security (VBS). With the help of an accessory that uses PCILeech, the attacker manages to modify/replace the biometric authentication code for fingerprints with a patch, so that they can enter using something as simple as a gummy bear. VBS nullifies this possibility by isolating fundamental elements (keys, signatures, etc.) from the standard session, both separated by hardware. When enabling the function, the attack is neutralized.
  • The next phase explains the role of TPM 2.0, which is to protect encryption keys, user credentials, and other sensitive data with a hardware barrier. At this point, we must remember that many computers already have support for TPM 2.0 (the video itself talks about "computers in the last five years"), but it is disabled in the UEFI. Many users can install Windows 11 without problems just by enabling it.
  • The combination of UEFI, Secure Boot, and Trusted Boot blocks attacks like the one we saw in the first example, or minimizes damage if the computer is already compromised. In the video, they teach us to enable Secure Boot, which in turn requires disabling Legacy Mode or CSM. Modifications to the boot sequence are rejected, and the computer returns to a conventional login of Windows 11.

Small Details

Why Is TPM 2.0 and Secure Boot Necessary in Windows 11?
One of our virtualized Windows 11 environments, receiving updates

One of the most interesting aspects appears at the end of the video, in which they essentially admit that the increase in security measures can impact equipment performance, and that's where the new Intel and AMD chips come in. Also, all security requirements in Windows 11 are optional under Windows 10, and can be enabled by the user whenever they want.

Regarding the attacks, I would like to add the following: On one hand, many of the results that Shodan presents reveal that RDP is exposed on computers with Windows 8.1 or lower, meaning that the problem is not a recent development. And on the other hand, if an attacker gains physical access to the device, it is not absurd to declare it compromised from the start. In summary, it never hurts to receive additional information, and the idea is that the user has greater decision-making power, whether they prefer to look for a new computer or extend the life cycle on perfectly functional hardware.

Source: Microsoft Mechanics on YouTube