Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
1–10 of 74 posts
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#2Very interesting video. For those who can't watch, he creates a PCB with a RPi Pico and some data pins which can sniff the BitLocker key as it's sent from the TPM chip back to the CPU. I was surprised to see that this was sent in plaintext, so although his board probably will only work for that particular motherboard, the method would be sound for other computers as well.
I'll leave the comments about MS requiring TPM chips for Win11 to others.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#3This is particularly interesting considering that TrueCrypt recommended migration to BitLocker as the main option for Windows: https://truecrypt.sourceforge.net/
IIRC Apple's version of TPM (Secure Enclave) should be immune to such attacks (since it's on the SoC, but I'm not sure whether the communication is encrypted or not), and the main data encryption method for GNU/Linux (LUKS) does not utilize TPM by default (might depend on distro though).
EDIT: I believe that the method in the video only works for volumes that aren't password/PIN-protected.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#4I predict that this will necessitate an upgrade to TPM 3.0 with a key exchange handshake mitigation along with it being a requirement to upgrade to Windows 12. That’s fine though because it will help with economic growth and all the relevant companies’ bottom lines.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#5Worth noting that modern AMD CPUs incorporate the TPM functionality in the CPU itself, not sure about Intel.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#6Worth noting that modern AMD CPUs incorporate the TPM functionality in the CPU itself, not sure about Intel.
AMD calls it fTPM (Firmware TPM I believe) and Intel calls it PTT (Platform Trust Technology)
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#7Nothing new. This attack is demonstrated here many times and the Microsoft docs discuss a similar attack using self encrypting drives. The counter measure is to use a virtual TPM built into the CPU or to use TPM+PIN (which is standard practice for security).
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#8Worth noting that modern AMD CPUs incorporate the TPM functionality in the CPU itself, not sure about Intel.
The most recent AMD CPUs, Zen4 also incorporate Pluton, the TPM designed by Microsoft based on Xbox security experience.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#9This is particularly interesting considering that TrueCrypt recommended migration to BitLocker as the main option for Windows: https://truecrypt.sourceforge.net/ IIRC Apple's version of TPM (Secure Enclave) should be immune to such attacks (since it's on the SoC, but I'm not sure whether the communication is encrypted or not), and the main data encryption method for GNU/Linux (LUKS) does not utilize TPM by default (m…
If you worry about someone sniffing your hardware buses, you should also worry about them intercepting your keyboard connection when you type the TrueCrypt password.
Re: Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]
#10TPM is insecure against physical attacks by design: https://gist.github.com/osy/45e612345376a65c56d0678834535166
The only secure implementation is called D-RTM which requires a level of chip, OEM, and OS support that's not done in practice.