This is for non-password Bitlocker with discrete TPMs that aren't configured to encrypt their exchange.
There's a mode of Bitlocker where it boots into a basic boot environment, asks the TPM for the key, the TPM validates the environment, and then gives the decryption key. For some discrete TPMs, this last step of the TPM giving the key to the boot environment is done in the clear and can be sniffed.
Comments
This is for non-password Bitlocker with discrete TPMs that aren't configured to encrypt their exchange.
There's a mode of Bitlocker where it boots into a basic boot environment, asks the TPM for the key, the TPM validates the environment, and then gives the decryption key. For some discrete TPMs, this last step of the TPM giving the key to the boot environment is done in the clear and can be sniffed.