[deleted]
Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
41–50 of 74 posts
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#42I'm lead to believe the TPM is a firmware TPM and not a hardware one. Is this correct?
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#43Earlier quoted context omitted.
There is nothing that is safe against physical attacks practically. You can always find a point where you can do a MITM attack as the communication channels between the TPM and anything else is almost always insecure.
>There is nothing that is safe against physical attacks practically. This! If security is your prime directive in your line of work(government, highly sensitive data, etc), then as long as your device has been outside your physical possession and in the hands of an untrusted third party, then it's automatically considered compromised and gets wiped or discarded by your IT department. Because no amount of marketing se…
> only good enough against the average thief off the street,
Even there, only Apple has effective protection against street-thieves. Nearly all other models of phones/laptops can have their anti-theft features reset by a guy in a dark alley with a flash programmer...
So far, most thieves aren't interested in your info, they just want to reset the hardware and give it a new serial number.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#44I'm lead to believe the TPM is a firmware TPM and not a hardware one. Is this correct?
Opposite - the TPM is hardware TPM and that's why it was easier to sniff the communication between it and the CPU over LPC. fTPM resides inside the CPU so sniffing is not as easy.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#45Earlier quoted context omitted.
It's a bit of a chicken-egg problem when the TPM is the root of trust for the entire system. Sure you can encrypt the data on the bus, but where do you store that key?
TPM can always store the (root) private key inside the TPM, but where will the other side of the channel (CPU, HD etc.) store their private key?
It could be burned into the CPU die by blowing fuses, or stored in a tiny bit of on-die flash, or stored encrypted in SPI flash, encrypted with a factory secret key burned into the CPU at manufacture.
But more generally, you don’t need a long term key to prevent sniffing attacks like this; Diffie-Hellman is a thing. Doing an unauthenticated DH would make this attack harder and slower (active MitM probably requires removing the TPM chip from the board) but would not prevent it.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#46Didn't know! After TC vanished with recommendation to use BL I had kept few files in direct Windows storage protected by BL. The more sensitive ones I still kept in Vera. Here my natural scepticism protected me lol.
Guess turning on pre boot pw is next thing to do.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#47TPM is insecure against physical attacks by design: https://gist.github.com/osy/45e612345376a65c56d0678834535166 The only secure implementation is called D-RTM which requires a level of chip, OEM, and OS support that's not done in practice.
There is nothing that is safe against physical attacks practically. You can always find a point where you can do a MITM attack as the communication channels between the TPM and anything else is almost always insecure.
Only a sith deals in absolutes (jk). Even with physical access, you can define restrictions that introduce some level of difficulty for a threat actor with limited capability. For example, you can just kick in most house doors to get past locks, but people still lock their doors. Cars are a better example, most car theft happens when people leave their doors unlocked.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#48To decrypt a drive with a TPM-only key you just need to turn on the PC . So what's the big deal here? It's disappointing that TPM-only is the default for Bitlocker, but you can just use something else (pin/password, key file, ...).
The default is an unencrypted computer. Microsoft is trying to improve that default without requiring yet another password.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#49No big deal here. This attack looks like it's using a crusty old TPM 1.2 laptop, so encrypted parameters to the TPM aren't supported. Even with Win11 and TPM2.0 (required for Win11), encrypted parameters to the TPM would just slow down an attacker. You need to use pre-boot auth, like a PIN. Obviously, the TPM needs to have some kind of authentication to release the key, not just the default mode where Windows just ne…
TPM without PIN is the default configuration, so I'd consider it to be a big deal.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#50I'm lead to believe the TPM is a firmware TPM and not a hardware one. Is this correct?
Opposite - the TPM is hardware TPM and that's why it was easier to sniff the communication between it and the CPU over LPC. fTPM resides inside the CPU so sniffing is not as easy.
That's compelling. I understand fTPM is less resistant to system level attacks because of the virtualization nature of it. Seems like a conundrum of tradeoffs.