Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

61–70 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#61

Post by withinboredom »

c4mpute wrote: post #15
FirmwareBurner wrote: post #5

>The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. Errr... no. Using no TPM of any kind decreases your security. The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data. Unencrypted communications over any channel, SW or HW are ba…

This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME modu…

I was always under the impression that once an attacker got physical access: all bets were off. Literally anything is possible at that point.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#62

Post by aeonik »

ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

This is a a major field called Digital Signal Processing, and it's fundamentally what a modem or the ADC in your sound card is doing.

I'm not aware of any single algorithm or software that can turn any raw signal to bytes. You need to figure out which modulating scheme the signal uses, and either find a decoder for it, or write your own.

Generally it's going to involve filtering, and other mathematical algorithms. But they tend to be pretty short and simple programs for basic decoding.

It's a pretty neat skill to learn because you can use the same techniques for all sorts of things. For example, once I learned a bit of DSP it unlocked a lot of abilities with Radio communication, Music and Sound design, image, and video processing.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#63

Post by zimmerfrei »

FirmwareBurner wrote: post #5

>The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. Errr... no. Using no TPM of any kind decreases your security. The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data. Unencrypted communications over any channel, SW or HW are ba…

>> The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data.

This is not really true. All TPMs (or at least since v2.0, but no matter if discrete or not) support encrypted session against passive eavesdroppers. There is also the possibility to protect against MiTM attacks, but that is more complex (since you then need to setup credentials).

See here [0]:

"Encryption sessions are useful for when the path to a TPM is not trused, such as when a TPM is a remote TPM, or when otherwise the path to the TPM is not trusted."

The issue is that the OS / Bootloader does not implement such mechanism.

[0] https://github.com/tpm2dev/tpm.dev.tutorials/blob/master/Int...

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#64

Post by gambiting »

Crontab wrote: post #47
controversial97 wrote: post #40

Earlier quoted context omitted.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#65

Post by sznio »

withinboredom wrote: post #58
brohee wrote: post #12

Earlier quoted context omitted.

Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).

Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.

If I remember correctly, you needed to replace the accessibility executable with cmd.exe for that to work.

Can't do that if the machine is encrypted. And if it's unencrypted there are better ways to reset the passwords.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#66

Post by cafeinux »

withinboredom wrote: post #58
brohee wrote: post #12

Earlier quoted context omitted.

Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).

Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.

Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#67

Post by withinboredom »

cafeinux wrote: post #66
withinboredom wrote: post #58

Earlier quoted context omitted.

Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.

Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?

If you can trick the computer into decrypting the disk, why does it matter which disk you actually boot from?

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#68

Post by ongy »

brohee wrote: post #59
ongy wrote: post #49

Earlier quoted context omitted.

Yes and no. Mostly no IMO The memory encryption features are a solution to very specific problems. If the CPU is able to access the memory, then any exploit that gains the execution context of the legitimate user can also access the memory. If it doesn't, the normal memory access control should be enough. I'm iffy on how well they protect against the various side channels. Mostly because I haven't looked far enough i…

Yeah I was unclear, it's supposed to address the physical attacks part. If no key leaves the CPU unwrapped, it's down to software exploits and decapping the CPU...

Gotcha. Yes

There's also this project https://www.cs1.tf.fau.de/research/system-security-group/tre... which reserves some CPU registers (iirc. A hardware aes accelerator on one core) to prevent key leakage.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#69

Post by mananaysiempre »

layer8 wrote: post #55
mananaysiempre wrote: post #34

Earlier quoted context omitted.

The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—wh…

Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.

I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention of them.

This article, however, says that this setup does not protect the data at all against a thief willing to pay $100 lifetime (not per machine), which seems an absurdly low bar. (And I’d wager you can go even lower by wiring up a cheap devboard—basically everything has a SPI peripheral these days.) I mean, liquid nitrogen is not exactly expensive either, but it does require some fuss, whereas the attack in TFA could be made essentially as easy as opening the case.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#70

Post by heavenlyblue »

vxNsr wrote: post #50
yomlica8 wrote: post #17

Earlier quoted context omitted.

This is also something to keep in mind when resale of SSDs is discussed and people recommend using the secure erase function of the SSD!

Yup, when I was working desktop support a few years ago my manager told me to just format the drive and send it back to dell at the end of the lease, they’d secure erase it anyway and the data was safe, I never trusted that and used dd to overwrite every bit of the ssd twice with junk data, I’m sure it decreased the longevity of the drive but wasn’t my problem and it felt cool to be the only desktop support guy who k…

SSD wear leveling mechanism would create new writes into different physical sectors so it was highly probable you were not in fct overwriting at least a proportion of the data
Post reply on HN