TPM and Bitlocker security

Question

On a computer running Windows with a hardware TPM, one can turn on bitlocker while let the computer unlock the drive on startup without asking for password. So if a drive is stolen or being accessed by hacker together with the matching TPM module or motherboard, the thief/hacker then can decrypt all data by design? So the bitlocker+TPM only protect if only the drive itself is stolen/accessed?

Answer 1

As long as the hardware attached to the mainboard is the same, yes.TPM modules are designed to "seal" a encrypted drive to your current hardware (mainboard, PCI card, ...) and low level software (UEFI/BIOS version and other firmware) and so they ensure the integrity of the system.They are also used to count how many times in a row you entered the PIN wrong and for example after the third time you can't access your keys anymore and they can also store other keys for you which then could also be bound to some condition.They can also perform key generation tasks for you in a more or less secure manner, encrypt a hash for example for creating a signature and many other things.

To make your TPM module more useful you can for example set a PIN and/or password.

Overview: https://technet.microsoft.com/library/cc732774.aspx

Helpful guides: https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10

https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/

For more options (like changing the lockout duration):

https://technet.microsoft.com/en-us/library/dn466535(v=ws.11).aspx

https://technet.microsoft.com/en-us/library/dd851452(v=ws.11).aspx

For nearly every existing option: https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-group-policy-settings