Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

81–90 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#81

Post by hutzlibu »

sublinear wrote: post #53
redox99 wrote: post #45

Earlier quoted context omitted.

Chassis intrusion is almost always just a small switch pushing against the side panel of the case. And yes there's a million ways you could bypass that.

Which sounds potentially unreliable on a laptop. Seems like a hard knock or even just normal material fatigue might be enough to release the switch.

One laptop of mine has such a sensor, but not for bitlocker.

After I opened it, it would just refuse to turn on, probably a safeguard when repairing and not wanting it to run anything.

But I did not know and thought I broke it, but after closing it again and tightening one screw in the middle, it worked and so I found that sensor. It is a very simple, but reliable push button and before it breaks, the screen will be broken long before that.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#82

Post by layer8 »

mananaysiempre wrote: post #69
layer8 wrote: post #55

Earlier quoted context omitted.

Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.

I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention…

I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#83

Post by jeroenhd »

hedora wrote: post #27
jeroenhd wrote: post #21

Earlier quoted context omitted.

I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access…

It sends escrow keys to your employer in enterprise environments. I’d be a bit surprised if the azure compromise a few weeks ago didn’t also give the attackers access to the escrow keys for customer vms, etc.

That's not a bypass, though, that's part of the design. If you're storing critical business info on company hardware that your boss can't access when you leave/get hurt, encryption becomes a business risk.

I don't know if key escrow is also fucked as well after the recent breach, but so far I haven't heard anything about it.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#84

Post by temac »

wbkang wrote: post #78
ixwt wrote: post #72

Earlier quoted context omitted.

This makes absolutely 0 sense. Bitlocker cannot be setup on Windows 10 Home edition.

It's called "device encryption" which seems to do the same thing and they allow it for Windows 10 home. It's confusing.

It's bitlocker but only activates if you log into a MS account in which case it:

* silently activates

* silently sends the key to MS.

And this is the only way to have it on home.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#85

Post by plonk »

brohee wrote: post #77
cafeinux wrote: post #66

Earlier quoted context omitted.

Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?

BitLocker is mostly worthless if you don't also password UEFI, disable booting off any other disk than the main one, and enable SecureBoot.

If you booted anything but the OS that set up BitLocker, wouldn't the TPM refuse to release the key?

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#86

Post by gquere »

als0 wrote: post #43
brohee wrote: post #2

TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.

fTPMs (firmware TPMs) are also very bad advice, because they have been remotely exploited using only software techniques.

OTOH they can be patched and to exploit them locally you either need software code exec or do a physical side-channel attack which is miles beyond a simple bus snooping.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#87

Post by gambiting »

temac wrote: post #84
wbkang wrote: post #78

Earlier quoted context omitted.

It's called "device encryption" which seems to do the same thing and they allow it for Windows 10 home. It's confusing.

It's bitlocker but only activates if you log into a MS account in which case it: * silently activates * silently sends the key to MS. And this is the only way to have it on home.

Ah. Which is probably what happened to me as I've signed into my MS account.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#88

Post by dekhn »

aeonik wrote: post #62
ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

This is a a major field called Digital Signal Processing, and it's fundamentally what a modem or the ADC in your sound card is doing. I'm not aware of any single algorithm or software that can turn any raw signal to bytes. You need to figure out which modulating scheme the signal uses, and either find a decoder for it, or write your own. Generally it's going to involve filtering, and other mathematical algorithms. Bu…

GNU radio has all the bits to do signal processing from raw analog data to symbols to bytes.

For example, I can use my SDR to record various signals in my neighborhood, make a guess that it's manchester encoded, then pass that signal to a symbol demodulaor, pass the symbols through a manchester decoder, then on to a protocol decoder (IIRC my tires have batteries and transmitters to send their pressure level to my car). GNU radio has bits for all these steps, but yeah, you kind of need to know the modulation schema and the codec scheme to make sense of it.

Here's a nice example: https://bkerler.github.io/OregonDecoder/

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#89

Post by plonk »

layer8 wrote: post #82
mananaysiempre wrote: post #69

Earlier quoted context omitted.

I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention…

I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.

Is there anything you could access from the keyboard or touchpad? Seems easy enough to only accept the inputs that the login screen needs and nothing else.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#90

Post by 4gotunameagain »

aeonik wrote: post #62
ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

This is a a major field called Digital Signal Processing, and it's fundamentally what a modem or the ADC in your sound card is doing. I'm not aware of any single algorithm or software that can turn any raw signal to bytes. You need to figure out which modulating scheme the signal uses, and either find a decoder for it, or write your own. Generally it's going to involve filtering, and other mathematical algorithms. Bu…

This is not DSP, this is just digital communication. DSP is digital manipulation of a sampled signal, whether that is infinite/finite impulse response filters (IIR, FIR), discrete fourier transform, discrete wavelet transform etc..
Post reply on HN