Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#71

Post by Vogtinator »

comex wrote: post #60
als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity…

Agreed. I don't see a way this can be done without one side trusting the other implicitly. If the sniffer/MitM gets either the measured data (to replay) or the unsealed key (to use directly) it's game over.

> I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with.

fTPMs are basically implemented within (or closely working together with) Intel ME reps. AMD PSP.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#72

Post by ixwt »

gambiting wrote: post #64
Crontab wrote: post #47

Earlier quoted context omitted.

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

This makes absolutely 0 sense. Bitlocker cannot be setup on Windows 10 Home edition.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#73

Post by gquere »

Karliss wrote: post #54
ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

Pulseview https://github.com/sigrokproject/pulseview and probably other parts of Sigrok project https://github.com/sigrokproject . Or since author mentioned DSlogic possibly the corresponding forks of those programs from the company making the logic analyzer.

Indeed I used DSView which is a fork of pulseview.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#74

Post by ixwt »

ComputerGuru wrote: post #52
controversial97 wrote: post #23

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

I’ve never seen a consumer device with chassis intrusion enabled by default. Were these maybe volume orders for a business account? Those can come with whatever configuration IT wants.

From all the computers that I've seen with intrusion detection on by default, they only give you a warning from what I've seen.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#75

Post by controversial97 »

Crontab wrote: post #47
controversial97 wrote: post #40

Earlier quoted context omitted.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

I can say from personal experience that for at least five years it has been common for small companies to buy a laptop direct from Dell and for it to have a bitlocker encrypted drive without anyone choosing that.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#76

Post by gambiting »

ixwt wrote: post #72
gambiting wrote: post #64

Earlier quoted context omitted.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

This makes absolutely 0 sense. Bitlocker cannot be setup on Windows 10 Home edition.

Well I upgraded to Pro about two days later, so maybe the upgrade did it? But either way, there was absolutely zero indication that the drive is getting encrypted or that it's going to save my recovery key to my Microsoft account.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#77

Post by brohee »

cafeinux wrote: post #66
withinboredom wrote: post #58

Earlier quoted context omitted.

Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.

Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?

BitLocker is mostly worthless if you don't also password UEFI, disable booting off any other disk than the main one, and enable SecureBoot.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#78

Post by wbkang »

ixwt wrote: post #72
gambiting wrote: post #64

Earlier quoted context omitted.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

This makes absolutely 0 sense. Bitlocker cannot be setup on Windows 10 Home edition.

It's called "device encryption" which seems to do the same thing and they allow it for Windows 10 home. It's confusing.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#79

Post by mike_hock »

ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

The article makes it sound easy. When the clock goes from low to high, the current level of the data line is the bit value, and you look for a one and seven zeros to find the start.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#80

Post by vladvasiliu »

Crontab wrote: post #47
controversial97 wrote: post #40

Earlier quoted context omitted.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

IME with win 11 pro, it won't encrypt the drive if you (jump through hoops to) create a local account. But as soon as you link it to MS, it will encrypt it.
Post reply on HN