Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#101

Post by bootsmann »

Crontab wrote: post #47
controversial97 wrote: post #40

Earlier quoted context omitted.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

It is default on in win 11, which is probably a huge privacy improvement for a majority of users. The recovery is sent to microsoft with your microsoft account, but against 99% of attacks (petty criminals stealing your laptop) this suffices.

If you fall into the category of users that distrust microsoft with their key, you can take active action and configure bitlocker yourself.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#102

Post by gquere »

layer8 wrote: post #82
mananaysiempre wrote: post #69

Earlier quoted context omitted.

I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention…

I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.

Only DMA comes to mind but it requires a non-hardened configuration which isn't that common on recent laptops + OS.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#103

Post by jfim »

als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

I wonder if that oversight is intentional and what would be the reason for it.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#104

Post by GordonS »

vladvasiliu wrote: post #48
FirmwareBurner wrote: post #19

Earlier quoted context omitted.

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be bl…

> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.

IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#105

Post by morpheuskafka »

controversial97 wrote: post #23

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

That's probably just relying on a push-button tamper switch which could be easily bypassed by cutting the back plastic instead. I doubt they are doing anything very fancy like running wires over the whole case.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#106

Post by FirmwareBurner »

vladvasiliu wrote: post #48
FirmwareBurner wrote: post #19

Earlier quoted context omitted.

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be bl…

> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.

It's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window.

It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#107

Post by Already__Taken »

kosasbest wrote: post #46

This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a VM typically to use certain software that has no Linux equivalent. I don't trust Bitlocker. Read somewhere Bruce Schneier uses Bitlocker for his daily computing, but I still don't trust it. After all, this is Microsoft we're talking about, who are in cahoots…

luks2 and Tang+Clevis is a pretty tidy solution. I have a host boot that I connect into the VPN and unlock the inner container volumes of code. I would like if it was built upon less shell scripts.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#108

Post by shuntress »

jrm4 wrote: post #7

Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.

> might be fine for certain work environments, but I wouldn't rely on it for anything truly personal

Funny, I feel the same way but to an opposite conclusion.

Hardware-locked encryption is basically the last thing I want on my notes/projects/code/pictures/etc.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#110

Post by tamimio »

>The use of a discrete (physical) TPM actually decreases the security

My laptop from 2015 didn’t have physical TPM and it prompted me when I tried to enable it: “Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)” and I thought it’s less secure.. the irony! Good thing I don’t use bitlocker anyway.

Post reply on HN