51–60 of 151 posts
Earlier quoted context omitted.
> One aspect of this is that some laptop manufacturers provide a setting to erase the TPM is the laptop is opened. Do you mean like if you remove the screws and get inside a laptop? Could they gain access by cutting the plastic instead (maybe Matrix parasite extraction style).
Could also use a light sensor or check if a circuit that runs on the inside of the case is broken.
Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.
Earlier quoted context omitted.
> One aspect of this is that some laptop manufacturers provide a setting to erase the TPM is the laptop is opened. Do you mean like if you remove the screws and get inside a laptop? Could they gain access by cutting the plastic instead (maybe Matrix parasite extraction style).
Chassis intrusion is almost always just a small switch pushing against the side panel of the case. And yes there's a million ways you could bypass that.
What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…
Or since author mentioned DSlogic possibly the corresponding forks of those programs from the company making the logic analyzer.
If you want Bitlocker to protect against someone stealing your laptop, you should be using a password anyway (and disable non-hibernation sleep modes).
The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—wh…
Earlier quoted context omitted.
Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…
I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.
Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.
I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access…
No, this is a Bitlocker problem. Systemd LUKS disk encryption uses encryption on the bus by enabling TPM encrypted sessions: https://github.com/systemd/systemd/commit/acbb504eaf1be51572...
Earlier quoted context omitted.
The point of this kind of encryption is that a removed hardrive can be sold or repurposed without data risk. Anyone can boot the laptop and get to the decrypted hard drive, what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop.
Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).
Earlier quoted context omitted.
At least TME-MK and its AMD equivalent are supposed to address in memory key stealing/memory bus snooping (even if it's still unclear to me how the key are generated/stored). There is still decapping and probing the CPU itself but given the size of features is that even remotely doable?
Yes and no. Mostly no IMO The memory encryption features are a solution to very specific problems. If the CPU is able to access the memory, then any exploit that gains the execution context of the legitimate user can also access the memory. If it doesn't, the normal memory access control should be enough. I'm iffy on how well they protect against the various side channels. Mostly because I haven't looked far enough i…
> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…
But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity somehow, even if this is done in a way that it can’t be worked around just by modifying some files on disk, what stops the attacker from running the same routine in an emulator?
I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with.