Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#111

Post by gnopgnip »

controversial97 wrote: post #40
layer8 wrote: post #30

Earlier quoted context omitted.

It’s good practice to have a copy of the recovery key somewhere.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

Most small companies will login with a microsoft account and have the key saved by default to https://myaccount.microsoft.com/

If you don't sign in with a microsoft account bitlocker isn't enabled by default. When you setup bitlocker it "forces" you to make a backup of the key

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#112

Post by 0xDEF »

Now that the TPM has been proven to be security theater Microsoft should drop the TPM requirement for Windows 11 and allow older machines to upgrade.

My previous job let me keep their 2016 laptop with an Intel i7 CPU, 32 GB RAM, and 512 GB SSD. Wonderful little bedtime laptop that is stuck on Windows 10.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#113

Post by c4mpute »

Guvante wrote: post #31
c4mpute wrote: post #15

Earlier quoted context omitted.

This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME modu…

What threat model assumes it is easier to attack fTPM than the OS that is running? Once you are online Bitlocker does nothing and you can just attack the OS and bypass all of its protections trivially... Your threat model here assumes arbitrary code execution as a starting point of an exploit, the security game is up for the PC once that occurs.

Any thread model should take firmware into account. There have been examples of unauthenticated remote code execution against Intel ME[0]. This isn't theoretical, this isn't an assumption, this has happened. Those exploits are independent of the OS running, with certain configurations the system doesn't even need to be switched on, just plugged in. With fTPM as an ME module (not all fTPMs are such) this provides an additional huge attack surface.

[0] https://mjg59.dreamwidth.org/48429.html

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#114

Post by Octabrain »

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it will protect my data if my hard disk is extracted from the laptop and attempted to run it from a different system.

Worth mentioning that this probably silly misconception is what makes me to always set a password for Bitlocker that I have to type manually which is what I've always done on LUKS.

Am I totally wrong?

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#115

Post by Rygian »

Octabrain wrote: post #114

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it w…

My guess: if you didn't set a password for the disk encryption, you have no protection for that scenario.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#116

Post by jsmith99 »

There's nothing new in this. The default configuration doesn't require a PIN but the Microsoft documentation explains the various attacks and recommends setting a Bitlocker PIN which completely prevents this. The PIN can be quite weak because the TPM prevents brute forcing. See eg https://learn.microsoft.com/en-us/windows/security/operating...

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#117

Post by mjg59 »

c4mpute wrote: post #113
Guvante wrote: post #31

Earlier quoted context omitted.

What threat model assumes it is easier to attack fTPM than the OS that is running? Once you are online Bitlocker does nothing and you can just attack the OS and bypass all of its protections trivially... Your threat model here assumes arbitrary code execution as a starting point of an exploit, the security game is up for the PC once that occurs.

Any thread model should take firmware into account. There have been examples of unauthenticated remote code execution against Intel ME[0]. This isn't theoretical, this isn't an assumption, this has happened. Those exploits are independent of the OS running, with certain configurations the system doesn't even need to be switched on, just plugged in. With fTPM as an ME module (not all fTPMs are such) this provides an a…

That vulnerability allowed unauthenticated access to AMT, not arbitrary code execution on the ME. I agree that an ME-based fTPM has a larger attack surface than a dTPM, but we haven't seen many cases where that's had real-world poor outcomes.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#118

Post by mjg59 »

etna_ramequin wrote: post #39
c4mpute wrote: post #15

Earlier quoted context omitted.

This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME modu…

> What would be better would be a dTPM that is integrated e.g. into a SoC, such that there are no exposed wires anywhere without decapping the SoC. Some systems such as phones work like that, but this is hard to tell even from the technical specs. That’s Microsoft’s Proton chip, I believe.

Pluton rather than Proton, but yes.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#119

Post by logical_person »

als0 wrote: post #36

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504…

authenticated sessions are practically useless on anything but a fully integrated device, because there is no guarantee of the SRK's identity - MITM is still possible.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#120

Post by itscrush »

Octabrain wrote: post #114

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it w…

Not entirely wrong, but may be missing how the key is now exportable adding risk to the scenario.

As you mention decryption key is provided automatically to the system. This means it's in RAM ready for export and re-use by bad actor against your encrypted disk. Cold boot attacks[1] are one of the attack vectors you'd want to read more on to figure out if this is valid for your threat model.

[1] https://en.wikipedia.org/wiki/Cold_boot_attack

Post reply on HN