Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

91–100 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#91

Post by mjg59 »

comex wrote: post #60
als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity…

"Authentication" here is something of a misnomer - it's setting up an encrypted session without any proof of identity. In that form it's sufficient to block passive sniffing and require an active MITM instead. The TPM's side of things can be tied back to the EK and hence can be validated against the vendor-issued EK certificate, so in theory this can be implemented in a way that avoids that risk, but that still involves a mechanism for bootstrapping the trust in the EK signing authorities and if that's not in the signed component of the boot chain then you're going to have problems.

I'm not sure what you're considering in the emulator case. Either the PCR values are going to be different or the TPM is going to be different, and in both cases that means you're not going to receive the decrypted secret.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#92

Post by kobalsky »

comex wrote: post #60
als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity…

> even if this is done in a way that it can’t be worked around just by modifying some files on disk, what stops the attacker from running the same routine in an emulator?

this is a question for an TPM expert. I'm a novice at this so take my reasoning with a grain of salt.

A software only emulation shouldn't fool the TPM since part of the secure boot process ties the hash of some PCR banks to the firmware, bootloader and kernel booted, so if you were to modify them in a way that allows you see the key, then it TPM wouldn't be able to produce the correct decryption key. I'm not sure if windows uses those PCR banks to secure bitlocker, but on other OSes you can.

I'm guessing that a hardware mitm would be possible with a discrete tpm, unless you use an aditional factor to boot as it usually recommended to prevent evil maid or cold boot attacks.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#93

Post by jeroenhd »

als0 wrote: post #57
jeroenhd wrote: post #21

Earlier quoted context omitted.

I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access…

> The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption. No, this is a Bitlocker problem. Systemd LUKS disk encryption uses encryption on the bus by enabling TPM encrypted sessions: https://github.com/systemd/systemd/commit/acbb504eaf1be51572...

I stand corrected, I'm glad systemd finally implemented encrypted TPM communication. I really don't understand why Microsoft is still allowing their keys to be MITM'd.

I really should switch from Grub to systemd but the lack of boot time configuration (and, slightly less importantly, theming support) still makes me prefer Grub.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#94

Post by voxic11 »

comex wrote: post #60
als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity…

You are correct, see section 6.3 https://github.com/nccgroup/TPMGenie/blob/master/docs/NCC_Gr...

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#95

Post by gquere »

psychphysic wrote: post #9
ballenf wrote: post #3

Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.

The point of this kind of encryption is that a removed hardrive can be sold or repurposed without data risk. Anyone can boot the laptop and get to the decrypted hard drive, what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop.

Can't do this attack if BitLocker is protected by PIN/passphrase, which is rarely the case.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#96

Post by gquere »

sznio wrote: post #65
withinboredom wrote: post #58

Earlier quoted context omitted.

Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.

If I remember correctly, you needed to replace the accessibility executable with cmd.exe for that to work. Can't do that if the machine is encrypted. And if it's unencrypted there are better ways to reset the passwords.

Well that's what I described. The drive was encrypted but there was no PIN so I just snooped the key, decrypted the drive and mounted it on another machine where I replaced sethc with cmd.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#97

Post by blibble »

heavenlyblue wrote: post #70
vxNsr wrote: post #50

Earlier quoted context omitted.

Yup, when I was working desktop support a few years ago my manager told me to just format the drive and send it back to dell at the end of the lease, they’d secure erase it anyway and the data was safe, I never trusted that and used dd to overwrite every bit of the ssd twice with junk data, I’m sure it decreased the longevity of the drive but wasn’t my problem and it felt cool to be the only desktop support guy who k…

SSD wear leveling mechanism would create new writes into different physical sectors so it was highly probable you were not in fct overwriting at least a proportion of the data

I can imagine the wear levelling function on some SSDs looks pretty similar to the encryptSector function

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#98

Post by 0xbadcafebee »

comex wrote: post #60
als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity…

MitM covers both passive and active. The traditional model for MitM was Telnet sessions, where a passive MitM would allow you to capture secrets and then initiate new sessions. With active mitm you can take over a session (or more!) but passive enables plenty of successful attacks, which is why you should use encryption, which MS didn't. lolz

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#99

Post by ysleepy »

gambiting wrote: post #64
Crontab wrote: post #47

Earlier quoted context omitted.

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

Windows marks the device as bitlocker enables somewhere in the EFI partition or GPT disklabels. I needed to wipe the whole disk to have windows cease with bitlocker bootscreens.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#100

Post by auguzanellato »

FirmwareBurner wrote: post #26
c4mpute wrote: post #15

Earlier quoted context omitted.

This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME modu…

>fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely Yes, fTPM is more vulnerable in theory to remote attacks, but fTPM could always be patched, while it's more difficult to de-solder the TPM chip off your motherboard and replace with a non-vulnerable one and th…

> but fTPM could always be patched

dTPMs can also be patched, the TPM in my Dell laptop is discovered by fwupd as being updatable.

Post reply on HN