Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

techspot.com

Post reply on HN
Print view View original

231–240 of 280 posts

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#231

Post by peapicker »

briffle wrote: post #173
layer8 wrote: post #88

Better writeup: https://infosec.exchange/@wdormann/116565129854382214 The published exploit doesn’t affect Bitlocker with a PIN, without which Bitlocker isn’t secure anyway. The original author claims they have an exploit that also works with a PIN, but hasn’t provided any proof of that.

Does your company require the pin? Or more importantly, does the company that your company pays for Cyber insurance require the pin? I have never seen a company where they require the pin for bitlocker.

My employer does, and 10 digits. (very large software company)

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#233

Post by wolvoleo »

gremlinunderway wrote: post #229
stackghost wrote: post #204

Earlier quoted context omitted.

If you worked for me and you said you're not capable of being part of a team I'd immediately start looking to replace you. You might be a 100x rockstar developer. You might even be the best software engineer in the world. But the vast majority of good software is built by teams of people. It doesn't matter how good you are if you can't play nice with others. I'd rather have a team of "merely" good engineers than one…

Yeah you've completely misread this. The phrase "not being a team player" is a euphemism for someone not willing to do dubiously unethical or illegal (or things that go against internal company policy) things in support of a low level supervisor or manager's wishes. Or more favourably, someone who's unwilling to do things outside of what he's actually paid for or to do things unpaid (or outside working hours etc.). A…

That is also a thing yeah. It's not really unethical or illegal but our VP has a huge preference for snazzy glitzy projects and never wants to tackle the problems that cause real pain in the organisation because they are not spectacular and don't make him look good. And yes I bring that up whenever it comes into play. I'm definitely not an order-follower.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#234

Post by TiredOfLife »

TacticalCoder wrote: post #123
seanieb wrote: post #11

At what point will Security professionals start turning down roles that involve “securing” MS Products? I’m already at this point. Securing Microsoft products is busy work while waiting to have it undercut by the next wave of MS’s insane tech debt and greed. And now backdoors!

> And now backdoors! "now"? Shall we have a discussion about the excuse Microsoft gave as to why keys they claimed, back then, were "secondary keys" belonging to Microsoft, were called ..._NSAKEY when a version of Windows NT shipped, by mistake, with debug symbols on? One time, just freaking one time, a version of Windows shipped with debug symbols on and, by chance, there had to be cryptographic keys named "NSAKEY"…

Microsoft has shipped debug symbols plenty of times.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#235

Post by abawany »

wolvoleo wrote: post #192
gusfoo wrote: post #172

Earlier quoted context omitted.

There is, sadly, no place for non-standard ICs in corpos nowadays. HR will enforce that.

Yeah I'm getting a lot of pressure to be a "team player" lately. I've told them over and over I'm not capable of that and that has never been a problem before. But we have a hipster new VP who is really pushy and wants to generalise everything.

I was once (12 years ago) told: "they debate, they decide, we deliver" along with other "teamwork" pablum. This evil has been with us for a very long time, unfortunately.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#236

Post by wolvoleo »

mananaysiempre wrote: post #198
wolvoleo wrote: post #189

Earlier quoted context omitted.

To be honest if I got fired in a mean or unfair way I'd definitely hit back at my employer in such a manner if I'd have the ability to. I'm unlikely to have that though as I'm not aware of any saucy company secrets. But if this is what happened I think it's pretty justified. The secret here seems to be that Microsoft caches the key somewhere even when it's supposed to be only in the TPM! That's a pretty big revelatio…

> The secret here seems to be that Microsoft caches the key somewhere even when it's supposed to be only in the TPM! Not what happened here (I reserve my judgment wrt the promised TPM+PIN exploit). In the default TPM-only mode of BitLocker, the secret is in fact in the TPM, which will (as instructed by Windows upon key creation) release it to the correct OS running on the correct computer. Notably not in the picture…

> Not what happened here (I reserve my judgment wrt the promised TPM+PIN exploit).

Yes this is the one I'm referring to.

I have noticed it myself, it has happened to me that my system rebooted to install updates and it did not pass through the blue TPM pin entry screen at that point. That was a big red flag for me. A normal reboot always does that, even a 'hot' reboot.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#237

Post by fortran77 »

This is a serious bug! I've just enabled TPM+PIN on all my Windows Machines (you need a PIN before the boot sequence starts) and enabled BIOS PINs (though those are easily circumvented) and Secure Boot (again, you can get a signed WinRE and still to this exploit). The TPM+PIN setting has no PoC, but the creator hints that it's possible even with this....

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#239

Post by ChocolateGod »

solenoid0937 wrote: post #191
bri3d wrote: post #151

Earlier quoted context omitted.

Previously discussed numerous times on HN, like: https://news.ycombinator.com/item?id=48130519 Whether this is a backdoor or not boils down to whatever your usual proclivities about "bug or backdoor" are; it's not like "if microsoft = 1 hack bitlocker" like the tech press seem to love to report. This is a bug in the NTFS transaction log replay functionality in the Windows Recovery Environment WinRE, where it will rea…

The author says he is able to use a similar vuln to bypass the PIN requirement. Most certainly a backdoor if true.

> Most certainly a backdoor if true

If Microsoft wanted a backdoor they don't need to put it in the WinRE environment. They can sign payloads that will pass the TPM and unlock bitlocker, without needing to store anything on your disk.

Post reply on HN