Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

errno.fr

Post reply on HN
Print view View original

41–50 of 151 posts

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#41

Post by Ian678 »

brunoqc wrote: post #32
controversial97 wrote: post #23

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

> One aspect of this is that some laptop manufacturers provide a setting to erase the TPM is the laptop is opened. Do you mean like if you remove the screws and get inside a laptop? Could they gain access by cutting the plastic instead (maybe Matrix parasite extraction style).

Could also use a light sensor or check if a circuit that runs on the inside of the case is broken.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#42

Post by vladvasiliu »

mananaysiempre wrote: post #34
layer8 wrote: post #28

If you want Bitlocker to protect against someone stealing your laptop, you should be using a password anyway (and disable non-hibernation sleep modes).

The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—wh…

The windows password is not required for Bitlocker. It doesn't work like macos' filevault.

You can configure a dedicated password for bitlocker, or a pin (can be alphanumeric) in addition to the tpm, but there's no link between that and your windows account once the os is booted.

I think MS' point about the standard bitlocker setup is that people can't just steal the drive and mount it in their own PC, they need your specific PC. And also, that windows is secure enough that if you have the correct PC with the drive and the OS boots, you can't open the windows session (which by default requires a password). So in this context, bitlocker adds some security while being "transparent".

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#43

Post by als0 »

brohee wrote: post #2

TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.

fTPMs (firmware TPMs) are also very bad advice, because they have been remotely exploited using only software techniques.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#44

Post by brohee »

ongy wrote: post #25
logical_person wrote: post #22

Earlier quoted context omitted.

that's still less secure, though. without a TPM you have no guarantee of the underlying state of firmware on the device. this enables a persistent backdoor. TPM with no PIN is practically bitlocker with no password. A high entropy PIN happens to solve this entire attack.

For the claim of GGP (stealing out of memory) it's worse, as that's still possible, and there's a bus the key travels over. The PCRs attest system state to the OS, yes. Though the verified boot (PSB/Secure Guard + Secure Boot) chain is supposed to provide the same security there. Provided we assume security features aren't broken by design...

At least TME-MK and its AMD equivalent are supposed to address in memory key stealing/memory bus snooping (even if it's still unclear to me how the key are generated/stored). There is still decapping and probing the CPU itself but given the size of features is that even remotely doable?

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#45

Post by redox99 »

brunoqc wrote: post #32
controversial97 wrote: post #23

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

> One aspect of this is that some laptop manufacturers provide a setting to erase the TPM is the laptop is opened. Do you mean like if you remove the screws and get inside a laptop? Could they gain access by cutting the plastic instead (maybe Matrix parasite extraction style).

Chassis intrusion is almost always just a small switch pushing against the side panel of the case. And yes there's a million ways you could bypass that.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#46

Post by kosasbest »

This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a VM typically to use certain software that has no Linux equivalent.

I don't trust Bitlocker. Read somewhere Bruce Schneier uses Bitlocker for his daily computing, but I still don't trust it. After all, this is Microsoft we're talking about, who are in cahoots with the NSA, and Redmond has NSA on speed-dial. Avoid Bitlocker if you really want to protect sensitive data.

(If you are going to use LUKS, use LUKS2 with a seven word passphrase). Currently this is the state-of-the-art for encrypting disks.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#47

Post by Crontab »

controversial97 wrote: post #40
layer8 wrote: post #30

Earlier quoted context omitted.

It’s good practice to have a copy of the recovery key somewhere.

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by conn…

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#48

Post by vladvasiliu »

FirmwareBurner wrote: post #19
jrm4 wrote: post #7

Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be bl…

> It's not compromised if you set a PIN/passkey, aka use it correctly.

The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#49

Post by ongy »

brohee wrote: post #44
ongy wrote: post #25

Earlier quoted context omitted.

For the claim of GGP (stealing out of memory) it's worse, as that's still possible, and there's a bus the key travels over. The PCRs attest system state to the OS, yes. Though the verified boot (PSB/Secure Guard + Secure Boot) chain is supposed to provide the same security there. Provided we assume security features aren't broken by design...

At least TME-MK and its AMD equivalent are supposed to address in memory key stealing/memory bus snooping (even if it's still unclear to me how the key are generated/stored). There is still decapping and probing the CPU itself but given the size of features is that even remotely doable?

Yes and no. Mostly no IMO

The memory encryption features are a solution to very specific problems.

If the CPU is able to access the memory, then any exploit that gains the execution context of the legitimate user can also access the memory. If it doesn't, the normal memory access control should be enough.

I'm iffy on how well they protect against the various side channels. Mostly because I haven't looked far enough into it.

IME it protects against cold boot attacks, a theoretic attack of a logic analyzer on the memory bus, and potentially to some degree unbounded reads. But the latter only with very limited gadgets.

Re: Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

#50

Post by vxNsr »

yomlica8 wrote: post #17
blibble wrote: post #13

Earlier quoted context omitted.

void encryptSector(struct context *c, long sector_no, unsigned char *data, size_t data_len) { // TODO }

This is also something to keep in mind when resale of SSDs is discussed and people recommend using the secure erase function of the SSD!

Yup, when I was working desktop support a few years ago my manager told me to just format the drive and send it back to dell at the end of the lease, they’d secure erase it anyway and the data was safe, I never trusted that and used dd to overwrite every bit of the ssd twice with junk data, I’m sure it decreased the longevity of the drive but wasn’t my problem and it felt cool to be the only desktop support guy who knew any Linux.
Post reply on HN