Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

techspot.com

Post reply on HN
Print view View original

81–90 of 280 posts

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#81

Post by kro »

patzentango wrote: post #76

I just digged into the exploit a little bit more and what it does it targets BitLocker in TPM only mode. That means that there is no preboot authentication or anything. What happens is secure boot validates the boot chain and the TPM gives out the encryption keys by itself. When you have physical access, it doesn't really make a difference. If there is a stick you can boot from and drop into an emergency shell or if…

Ubuntu also released TPM based FDE a few versions ago. I had these thoughts then and decided against using it. Typing my passphrase on boot is muscle memory and gives me simple security I can trust.

Also can recover data without my mainboard.

Maybe a hybrid (secureboot-TPM+phrase) slot for day to day to also prevent against evil maid attacks, and another slot with a backup passphrase would be acceptable.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#82

Post by archerx »

Glohrischi wrote: post #6
archerx wrote: post #4

Maybe I’m an outlier but I don’t want my drives encrypted at all. I rather have all my data be accessible if things go catastrophic, I.E. having to pull the drive out of a broken computer and put it in another computer to access the files. I just want it to be plug and play.

My harddrives (laptop, work laptop, desktop, server) contain emails, browser sessions, saved passwords, personal data from family and friends. I do not want someone stealing my laptop on a train ride potentially being able to have all of that data. With a proper real backup strategy, i have everything save. I do not need easy access to a hard drive from a broken computer. But hey you do you :)

My data is mundane and mostly my art projects and photography. I don’t believe I am important or interesting enough for someone to do anything with my data if they somehow managed to get it also I don’t have emails, saved passwords, banking info or that kind of sensitive info on my computers so meh I guess.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#83

Post by archerx »

mordae wrote: post #72
archerx wrote: post #4

Maybe I’m an outlier but I don’t want my drives encrypted at all. I rather have all my data be accessible if things go catastrophic, I.E. having to pull the drive out of a broken computer and put it in another computer to access the files. I just want it to be plug and play.

That's called LUKS2 and it's the default on Linux. You just type passphrase on boot. It's not tied to the motherboard.

What if you forget the passphrase after not using it for many years and you suddenly need a file on the drive?

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#84

Post by gruez »

patzentango wrote: post #76

I just digged into the exploit a little bit more and what it does it targets BitLocker in TPM only mode. That means that there is no preboot authentication or anything. What happens is secure boot validates the boot chain and the TPM gives out the encryption keys by itself. When you have physical access, it doesn't really make a difference. If there is a stick you can boot from and drop into an emergency shell or if…

>If there is a stick you can boot from and drop into an emergency shell

This won't work because the TPM will only give you the keys if you're booting an "approved" OS, specifically the PCR states that the encryption keys are bound to.

>or if you have to buy a $5 microcontroller and solder it to certain pins on the main board to sniff the TPM keys.

That only works with dTPMs. fTPMs aren't vulnerable to this, and are far more popular than dTPMs.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#85

Post by yellow_lead »

seanieb wrote: post #11

At what point will Security professionals start turning down roles that involve “securing” MS Products? I’m already at this point. Securing Microsoft products is busy work while waiting to have it undercut by the next wave of MS’s insane tech debt and greed. And now backdoors!

For enterprise, there seems to be so much money in doing it, that I don't think people are going to start turning it down just because it's troublesome.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#86

Post by kryogen1c »

From: https://infosec.exchange/@wdormann/116565129854382214

>In a normal WinRE session, you have a X:\Windows\System32 directory that has a winpeshl.ini file in it

>However, with the YellowKey exploit, it looks like Transactional NTFS bits on a USB Drive are able to delete the winpeshl.ini file on ANOTHER DRIVE

Interesting. I dont know about this environment - some kind of naive file handle contructing/passing? But then, why require a key press during winre reboot?

I wonder how patachable this is. The thousands of winre thumb drives are certainly out of reach; maybe the bitlocker side update the access permissions? Would it require unenc/reenc?

Seems like lots more to follow

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#87

Post by gruez »

kro wrote: post #81
patzentango wrote: post #76

I just digged into the exploit a little bit more and what it does it targets BitLocker in TPM only mode. That means that there is no preboot authentication or anything. What happens is secure boot validates the boot chain and the TPM gives out the encryption keys by itself. When you have physical access, it doesn't really make a difference. If there is a stick you can boot from and drop into an emergency shell or if…

Ubuntu also released TPM based FDE a few versions ago. I had these thoughts then and decided against using it. Typing my passphrase on boot is muscle memory and gives me simple security I can trust. Also can recover data without my mainboard. Maybe a hybrid (secureboot-TPM+phrase) slot for day to day to also prevent against evil maid attacks, and another slot with a backup passphrase would be acceptable.

>Typing my passphrase on boot is muscle memory and gives me simple security I can trust.

It's not an either-or. You can combine TPM with passwords which makes it far more secure than password alone. A TPM can enforce password guessing limits, otherwise a password needs to be absurdly long to be secure against GPU bruteforcing attacks. It also prevents someone from swapping out the bootloader with a backdoored version that steals your passwords.

>Also can recover data without my mainboard.

You're supposed to keep a backup of the encryption key when using TPM, in case it fails.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#88

Post by layer8 »

Better writeup: https://infosec.exchange/@wdormann/116565129854382214

The published exploit doesn’t affect Bitlocker with a PIN, without which Bitlocker isn’t secure anyway. The original author claims they have an exploit that also works with a PIN, but hasn’t provided any proof of that.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#89

Post by Brian_K_White »

SV_BubbleTime wrote: post #60
Alifatisk wrote: post #33

Earlier quoted context omitted.

Can’t wait to read the blogpost of what have truly happened and motivated this person to expose M$ like this

[flagged]

But nothing has changed. It's fair to say it's silly, jeuvenile, but it's also fair to say MS deserve absolutely no normal respect you would pay a turd. Maybe the poster actually is 12 and we all have a right to be 12 for a while. There's always a new generation discovering today what we discovered 30 years ago.

Re: Security researcher says Microsoft built a Bitlocker backdoor, releases exploit

#90

Post by dataflow »

patzentango wrote: post #76

I just digged into the exploit a little bit more and what it does it targets BitLocker in TPM only mode. That means that there is no preboot authentication or anything. What happens is secure boot validates the boot chain and the TPM gives out the encryption keys by itself. When you have physical access, it doesn't really make a difference. If there is a stick you can boot from and drop into an emergency shell or if…

They claim they have TPM + PIN exploit too, though how credible it is remains to be seen.

https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...

Post reply on HN