The author describes how to upgrade an otherwise compatible PC to Windows 11 despite it being deemed ineligible due to lack of TPM 2.0 support, using a simple workaround with Rufus and a USB drive, allowing users to bypass Microsoft's restrictions and upgrade in just 10 steps.
Originally Published 2 months ago — by Hacker News
The article argues that Windows 11's requirements like TPM and Secure Boot are not as restrictive as they seem and can promote security and user choice, but also highlights concerns about potential misuse for surveillance and platform lock-in. The author recommends promoting Linux to customers as a more open and flexible alternative, emphasizing ease of use, software availability, and control over privacy.
Many Windows 10 PCs that are flagged as incompatible with Windows 11 may actually be upgradeable by enabling Secure Boot and TPM in the BIOS, with simple tweaks and checks using Microsoft's PC Health Check app. If your hardware supports UEFI and Secure Boot, and you can enable TPM, you can often upgrade to Windows 11 for free, even if initial notifications suggest otherwise.
Many Windows 10 PCs, even those marked as incompatible, can be upgraded to Windows 11 for free by adjusting settings like Secure Boot and TPM in the BIOS, often without needing new hardware. The process involves checking compatibility with Microsoft's PC Health Check app, enabling UEFI, Secure Boot, and TPM in BIOS, and possibly modifying registry settings for older hardware. If hardware isn't compatible, adding TPM modules might be an option, but older systems may require replacement. Upgrading is recommended for security reasons, especially as support for Windows 10 ends.
The article explains two methods to upgrade incompatible Windows 10 PCs to Windows 11: a registry hack to bypass CPU and TPM checks, and using the Rufus utility to create a custom installation media that skips compatibility checks, allowing older or unsupported hardware to upgrade.
A security researcher demonstrated an exploit using a Raspberry Pi Pico and a custom PCB to break Microsoft's BitLocker drive encryption by sniffing the encryption key sent in plaintext from an external TPM chip to the laptop. While this exploit affects systems with discrete TPM chips, modern systems with firmware TPM modules integrated into the processor are not vulnerable. The exploit highlights the importance of understanding the type of TPM used in a system and the potential vulnerabilities associated with different TPM implementations.
YouTuber stacksmashing demonstrated how he used a $5 Raspberry Pi Pico to intercept BitLocker encryption keys via the Trusted Platform Module's unencrypted communication lanes, allowing him to decrypt data in 43 seconds. This method requires physical access to the device and an external TPM module, highlighting potential vulnerabilities in BitLocker's security. Microsoft acknowledges these attacks are possible but suggests they require sophisticated tools and long physical access, while newer devices with fTPM and BitLocker PIN configurations may offer more secure alternatives.
A security researcher demonstrated how Bitlocker keys can be stolen in just 43 seconds using inexpensive hardware, highlighting a vulnerability in the widely used Windows encryption system. By exploiting the Trusted Platform Module (TPM) and the LPC bus, the attacker was able to intercept the encryption key from an older Lenovo Thinkpad, showcasing the potential risk of key theft. While modern computers with TPM inside the CPU may require more sophisticated hardware to carry out such an attack, the demonstration underscores the importance of securing encryption keys to prevent unauthorized access to sensitive data.