Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

youtube.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#61

Post by FirmwareBurner »

londons_explore wrote: post #43
FirmwareBurner wrote: post #23

Earlier quoted context omitted.

>There is nothing that is safe against physical attacks practically. This! If security is your prime directive in your line of work(government, highly sensitive data, etc), then as long as your device has been outside your physical possession and in the hands of an untrusted third party, then it's automatically considered compromised and gets wiped or discarded by your IT department. Because no amount of marketing se…

> only good enough against the average thief off the street, Even there, only Apple has effective protection against street-thieves. Nearly all other models of phones/laptops can have their anti-theft features reset by a guy in a dark alley with a flash programmer... So far, most thieves aren't interested in your info, they just want to reset the hardware and give it a new serial number.

Most other makes of phones and laptops aren't as valuable as Apple's to be big targets of theft. And Samsung has KNOX and Pixels have Google's Titan security.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#62

Post by darkclouds »

ghostpepper wrote: post #15
aquova wrote: post #2

Very interesting video. For those who can't watch, he creates a PCB with a RPi Pico and some data pins which can sniff the BitLocker key as it's sent from the TPM chip back to the CPU. I was surprised to see that this was sent in plaintext, so although his board probably will only work for that particular motherboard, the method would be sound for other computers as well. I'll leave the comments about MS requiring TP…

It's a bit of a chicken-egg problem when the TPM is the root of trust for the entire system. Sure you can encrypt the data on the bus, but where do you store that key?

[dead]

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#63

Post by mr_mitm »

whyoh wrote: post #12

To decrypt a drive with a TPM-only key you just need to turn on the PC . So what's the big deal here? It's disappointing that TPM-only is the default for Bitlocker, but you can just use something else (pin/password, key file, ...).

The "big deal" is just seeing it demonstrated this quickly. TPM-Sniffing is an old hat [1], but I always thought it would take at least hours of painstaking fiddling with a soldering iron. I find this video impressive and eye opening.

[1] https://www.orangecyberdefense.com/ch/insights/blog/tpm-snif... (2021)

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#64

Post by krab »

sneak wrote: post #45
northern-lights wrote: post #21

Earlier quoted context omitted.

TPM can always store the (root) private key inside the TPM, but where will the other side of the channel (CPU, HD etc.) store their private key?

It could be burned into the CPU die by blowing fuses, or stored in a tiny bit of on-die flash, or stored encrypted in SPI flash, encrypted with a factory secret key burned into the CPU at manufacture. But more generally, you don’t need a long term key to prevent sniffing attacks like this; Diffie-Hellman is a thing. Doing an unauthenticated DH would make this attack harder and slower (active MitM probably requires re…

Maybe it would be more practical MITMing near the CPU. Some plastic "extender" routing the relevant pins through an external device but still allowing for cooling?

But could the communication be authenticated? Like in CPU having a public cert, self signed. TPM then can authenticate the CPU that generates the key and later sends it only over an authenticated TLS session to the same CPU.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#65

Post by mathisdiego »

Dowwie wrote: post #60
briHass wrote: post #30

No big deal here. This attack looks like it's using a crusty old TPM 1.2 laptop, so encrypted parameters to the TPM aren't supported. Even with Win11 and TPM2.0 (required for Win11), encrypted parameters to the TPM would just slow down an attacker. You need to use pre-boot auth, like a PIN. Obviously, the TPM needs to have some kind of authentication to release the key, not just the default mode where Windows just ne…

Interesting... A PIN auth step eliminates the convenience value proposition of a TPM. Selling passwordless authentication as a solution requiring a PIN just isn't recognizing that the PIN is now the password.

I think that's a bit of an overstatement. You already enter a password to sign in (or not, if you use biometrics). This is just another password that you enter once at boot. Doesn't seem all that bad of a tradeoff for data security.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#66

Post by briHass »

Dowwie wrote: post #60
briHass wrote: post #30

No big deal here. This attack looks like it's using a crusty old TPM 1.2 laptop, so encrypted parameters to the TPM aren't supported. Even with Win11 and TPM2.0 (required for Win11), encrypted parameters to the TPM would just slow down an attacker. You need to use pre-boot auth, like a PIN. Obviously, the TPM needs to have some kind of authentication to release the key, not just the default mode where Windows just ne…

Interesting... A PIN auth step eliminates the convenience value proposition of a TPM. Selling passwordless authentication as a solution requiring a PIN just isn't recognizing that the PIN is now the password.

You're forgetting the other convenience value of the TPM in Windows, which is that it allows you to use a PIN/bio instead of your (hopefully) long and complex account password.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#67

Post by briHass »

i5-2520M wrote: post #58
briHass wrote: post #30

No big deal here. This attack looks like it's using a crusty old TPM 1.2 laptop, so encrypted parameters to the TPM aren't supported. Even with Win11 and TPM2.0 (required for Win11), encrypted parameters to the TPM would just slow down an attacker. You need to use pre-boot auth, like a PIN. Obviously, the TPM needs to have some kind of authentication to release the key, not just the default mode where Windows just ne…

With an ISO install, only 1.2 is required for Win11. TPM2 ia inly required to get the update offer from 10.

You can also set a registry key to ignore TPM/CPU requirements with the regular upgrade tools.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#68

Post by _cenw »

H8crilA wrote: post #25
ghostpepper wrote: post #15

Earlier quoted context omitted.

It's a bit of a chicken-egg problem when the TPM is the root of trust for the entire system. Sure you can encrypt the data on the bus, but where do you store that key?

You use a Diffie-Hellman key exchange, signed by a cert stored in the CPU on one side and verified by the TPM on the other. CPUs already have such secret certs inside of them, for example for Intels' SGX. But as you can read in the article linked by /u/osy, the TPM ecosystem is a victim of design by committee where such things as a threat model are not a thing. They were focused on building a "generic security soluti…

Or you use fTPM, the one inside your CPU, which is how most computers that run Windows 11 (without bypassing the restrictions) do it.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#69

Post by qingcharles »

northern-lights wrote: post #20
osy wrote: post #10

TPM is insecure against physical attacks by design: https://gist.github.com/osy/45e612345376a65c56d0678834535166 The only secure implementation is called D-RTM which requires a level of chip, OEM, and OS support that's not done in practice.

There is nothing that is safe against physical attacks practically. You can always find a point where you can do a MITM attack as the communication channels between the TPM and anything else is almost always insecure.

I use to work in Microsoft DRM. I used to say: the key is on the machine! This is like leaving your house key under a rock in the garden. It just puts up a barrier of a certain level which puts off most villains.

If you want secure Bitlocker, use a password.

Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

#70

Post by ale42 »

shawnz wrote: post #26
ale42 wrote: post #17

Earlier quoted context omitted.

Except that if you can sniff the encryption keys, you can tamper with the OS and for example remove the password...

That's why I caveated my explanation with "these kinds of attacks aside": this video describes such a bus sniffing attack

I've read your message too quickly ;)
Post reply on HN