Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
1–10 of 151 posts
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#2TLDR if you actually want to act upon that :
Takeaways
The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem.
If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#3Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#4TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
> If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
I always considered that BitLocker without a PIN is 80% convenience and 20% security.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#5>The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem.
Errr... no. Using no TPM of any kind decreases your security.
The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data.
Unencrypted communications over any channel, SW or HW are bad and dTPM never claimed it would protect you from that, but it's still better than no-TPM, and have your keys in system memory or on the disk where it could be accessed through software vulnerabilities.
Of course fTPM, is the next step up in security, even though that's also not impenetrable to attackers with the right side channel analysis equipment and expertise, but security threat model is anyway a matter of time and budget of your attackers, nothing can ever be 100% invulnerable to everything.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#6TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
> The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem.
Since only dTPM can be FIPS certified, I don't see how an uncertifiable piece of hardware can be more secure.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#7Bitlocker is the Windows one, that's essentially known to be compromised, right?
Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#8Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.
It's shared between a couple of components, but not nearly all of them. These days pretty much just the boot flash and the TPM (and the CPU itself as the bus master) are sitting on that SPI bus.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#9Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.
The point of this kind of encryption is that a removed hardrive can be sold or repurposed without data risk.
Anyone can boot the laptop and get to the decrypted hard drive, what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop.
Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
#10TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
> If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary. I always considered that BitLocker without a PIN is 80% convenience and 20% security.
IIRC earlier versions of bitlocker would rely upon SSD firmware implementations for drive encryption. They stopped doing that when it was revealed many of these hardware encryption systems in common drives didn't actually work.