Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

121–130 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#121

Post by tedunangst »

Octabrain wrote: post #114

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it w…

Windows is not supposed to let anyone access the files until they enter the correct account password. So the disk will decrypt in this computer, but then Windows prevents access.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#122

Post by ack_complete »

ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

For decoding old FSK tapes, look into sliding Goertzel filters. They're easy to implement filters that extract the amplitude of a frequency bin within a sliding window, and are often referenced in literature about DTMF decoding. Compare the outputs of a pair of these to produce a digital output. You can also use a sparse sliding DFT, but interpolating between frequency bins is more of a hassle, whereas the Goertzel filter handles that for you.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#123

Post by als0 »

plonk wrote: post #85
brohee wrote: post #77

Earlier quoted context omitted.

BitLocker is mostly worthless if you don't also password UEFI, disable booting off any other disk than the main one, and enable SecureBoot.

If you booted anything but the OS that set up BitLocker, wouldn't the TPM refuse to release the key?

That is correct.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#124

Post by vel0city »

Octabrain wrote: post #114

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it w…

It requires the attacker to bypass the login, extract the key from memory from the system, or potentially with a physical TPM this style of attack. This is probably a lot more sophisticated of an attack than a random thief trying to make a quick buck stealing an expensive computer. Chances are they'll just end up wiping the drive and try to sell it rather than actually try a cold boot attack, but it all depends on your threat profile.

Personally I mostly use FDE on personal machines so I don't have to care much about physical destruction when I need to get rid of storage devices. If a hard drive fails I don't need to actually tear it apart to make sure my data is gone. My device is usually in sleep mode when I'm out and about so if they were going to do a cold boot attack they could do it anyways.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#125

Post by o1y32 »

controversial97 wrote: post #23

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

Off topic -- The joke is that you can hardly find a laptop with upgradable RAM these days. Not even on some ThinkPad lines. Gaming laptops often do.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#126

Post by snvzz »

jeroenhd wrote: post #93
als0 wrote: post #57

Earlier quoted context omitted.

> The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption. No, this is a Bitlocker problem. Systemd LUKS disk encryption uses encryption on the bus by enabling TPM encrypted sessions: https://github.com/systemd/systemd/commit/acbb504eaf1be51572...

I stand corrected, I'm glad systemd finally implemented encrypted TPM communication. I really don't understand why Microsoft is still allowing their keys to be MITM'd. I really should switch from Grub to systemd but the lack of boot time configuration (and, slightly less importantly, theming support) still makes me prefer Grub.

>I'm glad systemd finally implemented encrypted TPM communication.

Note that, as far as I am aware, it never implemented unencrypted TPM communication.

That's Microsoft-specific insanity.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#127

Post by kotaKat »

jsmith99 wrote: post #116

There's nothing new in this. The default configuration doesn't require a PIN but the Microsoft documentation explains the various attacks and recommends setting a Bitlocker PIN which completely prevents this. The PIN can be quite weak because the TPM prevents brute forcing. See eg https://learn.microsoft.com/en-us/windows/security/operating...

Also amusingly, as far as I'm aware, Windows Defender now by default blocks any accessibility-based escalation attacks -- Behavior:Win32/AccessibilityEscalation.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#128

Post by kristjank »

I find the fact that the old elementary school trick of renaming Command prompt to the accessibility handler still works as well as it used to in the Windows Vista days incredibly funny. You would imagine Windows would authenticate something that runs with admin perms with no login required. Windows seems to be 75% security theather and about 25% other types of theather.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#129

Post by matja »

ggambetta wrote: post #37

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Freque…

The loading routines from that era just count the number of DC zero-crossings and convert X crossings into a 0 and Y crossings into a 1, they don't care about frequency or amplitude (the raw signal is usually fed into a Schmitt trigger to implement hysteresis for a stable edge). That way, the polarity of the tape signal and the variation of the motor is compensated for.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#130

Post by etna_ramequin »

mjg59 wrote: post #118
etna_ramequin wrote: post #39

Earlier quoted context omitted.

> What would be better would be a dTPM that is integrated e.g. into a SoC, such that there are no exposed wires anywhere without decapping the SoC. Some systems such as phones work like that, but this is hard to tell even from the technical specs. That’s Microsoft’s Proton chip, I believe.

Pluton rather than Proton, but yes.

Yes, that’s right, thanks!
Post reply on HN