16 ms·
BitLocker Lockscreen Bypass
- sanqui 6y agoReminds me of this classic Windows 98 (I believe) login screen bypass. https://i.imgur.com/rG0p0b2.gif https://i.imgur.com/rG0p0b2.gif
- dexen 6y agoAh, a classic. The flat color top bar suggests it's Windows 95, rather than the 98 (which used a color gradient): https://imgur.com/a/4uamhPu https://imgur.com/a/4uamhPu
- Kwpolska 6y agoIt might also be Windows 98 running in 16 color mode.
- kasabali 6y agoalso might be gif dithering
- Lammy 6y agoIt's Windows NT 4.0 https://en.wikipedia.org/wiki/Windows_NT_4.0 https://en.wikipedia.org/wiki/Windows_NT_4.0 http://toastytech.com/guis/nt4.html http://toastytech.com/guis/nt4.html
- axegon_ 6y agoI didn't know that one back then but there was another one, where you could remove a file(or rename it) from C:/Windows(I don't remember which one it was, but 10 year old me definitely knew, but somehow I think it was C:/Windows/passwd) from DOS. Then you type in any password and it let you in and then you just swap the file with the old one once you are done. Sigh the number of times my classmates asked me to use it on our math teacher's computer in order to copy the tests...
- afandian 6y agoOur target was Visual Basic 3. You could start it through Microsoft Access, which somehow let you execute arbitrary commands.
- neltnerb 6y agoDon't forget hypercard, that let us run whatever we wanted on Macs. On windows though, we discovered that if you use the save or open dialogs you can just browse wherever, right click, and run the exe. It sounds like that was a bit before your time, security was even more laughable then. Oddly, the network was set up perfectly, at least according to the standards of the time.
- brian_herman 6y agoI think you are thinking of this one use it all the time at work. https://4sysops.com/archives/reset-a-windows-10-password/ https://4sysops.com/archives/reset-a-windows-10-password/
- gruez 6y agoThat's not exactly the same, because it's essentially modifying the operating system files to bypass the security checks, whereas this article and the gif are basically loopholes in the OS that gives you access.
- axegon_ 6y agoCould be(or something similar I guess, I moved over to the penguin army in 2000).
- elteto 6y agoYou could bypass the screensaver lock this way. If the C: drive was shared over the network (and more often than not it was!) you could just rename c:\windows\scrnsave.exe and the process would crash. Fun times!
- harikb 6y agoWell technically that is possible in any OS. You can mount the drive elsewhere or to a live cd, change root password. That is the recommended way to recover from lost root password (assuming FS is not encrypted - which was the case you were talking about) Let us assume one can’t easily modify the filesystem or special boot options are not available
- transcriptase 6y agoAnother fun one in the early 2000s was if your organization was using Novell Groupwise, you could run any executable by renaming it nalwin32.exe Good times playing Age of Empires and Half Life on school computers over LAN using that!
- girvo 6y agoAlso, you could drop into the Visual Basic editor from any office program: the File > Open dialog would happily launch any executable under Novell lol. We played Quake mostly!
- ashleyn 6y agoFirst thing I thought of. Can't even believe this kind of stuff is still happening in Windows in 2021.
- bitexploder 6y agoHappened to iOS a while ago too.
- sudeepj 6y agoCompared to today, when I see Win9x & WinXP I feel a strange bit of innocence and how simple it was back then, both for individual developers & industry as a whole. (kinda difficult to articulate what I want to say) May be its not the Windows but 90s & early 2000s ... don't know.
- meibo 6y agoAbsolutely - I'd like to know why exactly MS decided to make the classic theme unaccessible. On early Windows 10 versions, you were able to re-enable it by stopping the window manager from creating the modern theme resources, I'm not sure if that still works but it leads me to think that they did it for brand reasons. Classic theme is distinctly "old" and they probably wanted to get rid of that conception.
- high_priest 6y agoThey did not reek with "EvilCorp software, big brother watching your moves". It was just "entusiast made software". It felt human made.
- garaetjjte 6y agoAndroid FRP is also bypassed by various tricks like this. (usually involving starting Talkback, going into help, there clicking on YouTube video, clicking something to open browser...etc)
- sodality2 6y agoYep. Exactly what I did a few months ago to bypass FRP
- flomo 6y agoI'll be that guy and mention that Windows 9x had no local security and this was considered NOTABUG. You could also press F8 to drop to DOS and run something like win.exe /nonetwork.
- vimy 6y agoI wonder how people find glitches like this.
- thestepafter 6y agoYou have to understand the data at a structural level and how it flows through the application. Then you can identify entry points to access that data using non-traditional methods that the developers may not have considered when implementing security features. That, or get lucky by clicking around a lot.
- Blackthorn 6y agoFor me, it was boredom and cheapness. Once my trial copy of Win2k ran out and it confronted me with it, I tried hitting ctrl+alt+del. To my surprise, it worked. So from there I was just able to launch explorer.exe. I was a kid then. Kids these days are finding these sorts of "exploits" in phones and whatnot all the time.
- mike-cardwell 6y agoReminds me of that classic OSX root login bypass by not using a password from 3 years ago: https://ma.ttias.be/root-login-without-password-allowed-default-mac-osx-high-sierra/ https://ma.ttias.be/root-login-without-password-allowed-defa...
- sslalready 6y agoReminds me of the Solaris TTYPROMPT in.telnetd bypass: https://packetstormsecurity.com/files/114491/Solaris-TTYPROMPT-Remote-Login-Bypass.html https://packetstormsecurity.com/files/114491/Solaris-TTYPROM...
- mkr-hn 6y agoDon't forget booting Linux in single user mode with a simple GRUB edit to bypass the login.
- SteveNuts 6y agoThis one makes sense to me, if someone has access to the console during boot, there's not much sense in preventing them from logging in. At that point they could just pull the drive and mount it in a different computer and replace passwd and shadow. If you want to prevent this you need full disk encryption
- vbezhenar 6y agoJust full disk encryption does not solve the problem fundamentally. Malicious user with physical access could just install keylogger into bootloader which would log the password on the next boot. To protect from that threat you need secure boot which verifies checksums from BIOS to kernel.
- rocqua 6y agoFull disk encryption alone suffices against device theft, presuming the device is turned off. More complicated threat models like an evil-maid attack are much harder to defend against. Secure boot, and temper-evident device seals, form the outline of a solution. As far as I know though, these are still far from foolproof. Really I would say defending from an evil maid attack is still an open problem. Something very similar holds for theft of devices that are still on.
- deleted 6y ago[deleted]
- bouke 6y agoThere was (and still is) misconception regarding that screen. That screen is for authenticating on the network. I believe you could also just close the dialog. It’s not for authenticating a local user account. Failing to authenticate you just couldn’t access network shares.
- AnssiH 6y agoI believe that depends on the configuration. The error dialog in the gif when Cancel is pressed does say "You cannot use Windows unless your login name is validated by the network."
- sitharus 6y agoI recall being able to just cancel that dialog back in the day. There was a group policy to require network authentication added at some point, but I don't know when.
- donmcronald 6y agoYeah. I swear you could just hit escape at that screen.
- Multicomp 6y agoYou can if the GPO is not set. Source: just tested on my Compaq AiO CRT on reserve duty as a floppy to continuous paper printer adapter
- ars 6y agoNope, I did that on a college computer, with no one logged in. I'm pretty sure it was Windows NT (not 95). Just messed around until I found that accidentally, and I was able to run commands. It would have been around 18 years ago, something like that.
- lloeki 6y agoWe very much for sure used this trick (and others) to go around network authentication back in college days: we had individual network accounts and only the admin had a local account. Poor fella ended giving up cleaning our mIRC and Starcraft installs.
- sirsinsalot 6y agoThere was a similar Novell NetWare bypass that allowed admin access to local and all the shares via help to explorer
- millzlane 6y agoNT
- wilhil 6y agoHeh! Memories! RM Networks ~1998/1999 when I was in School... You would login and then you got their interface popup saying you were over your space allowance and clear files or you can't login... I did this exact same trick (passed network login though) to get out of it! Although, mine was to go to c:\windows, type . then right click explorer.exe and click open!
- SiebenHeaven 6y agoExcellent example of why one should attempt to limit attack surface.
- miki123211 6y agoAccessibility features are a great source of security vulnerabilities. I rely on them myself, and have personally found or witnessed quite a few.
- Daniel_sk 6y agoSame in Android - it's used by most malware.
- SquareWheel 6y agoOne example might be audio captchas. They're needed, of course, but it means there's two avenues open to attackers now.
- miki123211 6y agoAudio captchas don't really solve the underlying problem. Yes, they make things easier for english-speaking blind people with no hearing problems, but that's about it. From an accessibility perspective, the only solution that makes sense is pervasive surveillance to determine if you're human or not.
- resynth1943 6y agoI'm not really talking about this from an a11y standpoint, but audio CAPTCHA's are so much easier than "choose the fire hydrant" hell. I actually remember reading a post saying that an accessible CAPTCHA is hard. To make it accessible, you have to make it machine-readable, which defeats the point...
- nine_k 6y agoA lock needs not be unbreakable. It only needs to be more expensive to break than the value of the things it protects. So captchas should only be hard enough to make complicated setups involving ML models or pipelines to Mechanical Turk not worth it. Pervasive surveillance is an overkill for this particular purpose.
- userbinator 6y ago
- wongarsu 6y agoMicrosoft's fix seems to have only fixed the sticky-keys dialog [1], apparently by just removing the link to the settings when you are in a lockscreen. So if you manage to find another way to launch the settings from a lockscreen everything else should still work as described. 1: https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-1398 https://msrc.microsoft.com/update-guide/en-us/vulnerability/...
- ROARosen 6y agoForm a security standpoint I don't understand why Microsoft would even 'launch' any app (that's not necessary for login) while lock screen is on. The lock screen should be completely decoupled. It would be like trying to enter a URL in a browser while the browser app is closed which is basically impossible (I'm not talking about adding it as a cmd param).
- sp332 6y agoAccessibility tools are necessary for login.
- Retric 6y agoThen they should be part of the login application.
- derefr 6y agoThat would be even worse than the current state of things. Accessibility services are necessarily kernel services, since they tie deeply into considerations of what the OS should/shouldn’t allow the user to do at any point. Giving the login application its own copy of those services, would mean giving the login application (⇒ applications in general) the ability to tie as deeply into the OS as the accessibility services themselves do. Avoiding that is the whole reason accessibility was made an OS-level feature in the first place!
- 6y ago
- dexen 6y agoRelated: yesterday's post by jwz, "I told you so, 2021 edition" [1], which discusses security bypass in linux screensavers. [1] https://news.ycombinator.com/item?id=25801693 https://news.ycombinator.com/item?id=25801693
- Jon_Lowtek 6y agoWhat does this have to do with Bitlocker? EDIT: i get it now, it plays a small part in the exploit chain because it doesn't correctly verify what it sets permissions on when automounting usb drives.
- eznzt 6y agoNothing, but it sounds more severe if you involve bitlocker somehow.
- The_big_unknown 6y agoThere's less need to jump through all these hoops if you have physical access to a PC with enabled USB ports. For example: you could boot from the USB device and access the local storage if it's not encrypted. EDIT: I meant to say "if you have physical access without Bitlocker enabled". Bitlocker is protecting the contents of the storage, if you can bypass the lockscreen on a Bitlocker protected computer you've evaded this protection.
- Speednet 6y agoBut this article is about bypassing Bitlocker, so that's not relevant. Also, if a system is unencrypted there are a multitude of ways to easily read the contents. That goes for any device or operating system.
- Jon_Lowtek 6y agoThe article is about bypassing the Windows Lockscreen, it is not about bypassing Bitlocker.
- deleted 6y ago[deleted]
- segfaultbuserr 6y agoThere are two approaches to full disk encryption. The first one is the traditional approach: The encryption is applied independently from the operating system. The key is controlled by the user. The system cannot even boot without the correct key because the underlying hard drive is inaccessible. The disadvantage is the need of entering (very long) keys manually on boot. The second approach, which is popular on phones and tablets, is to use disk encryption transparently, usually with hardware assistance. On boot, the key is automatically filled in by hardware (TPM for BitLocker) when some conditions are met, no passphrase is asked. In this case, the disk encryption employed is not really a "true" encryption [0], instead, it's an extension of operating system's authentication mechanism. BitLocker's sole purpose is to prevent anyone from bypassing the login screen by pulling out the hard drive, rewriting the password, and putting the hard drive back in. It's also why smartphones can be reasonably secure even with a 4-digit PIN. This authentication exploit bypasses the login screen despite BitLocker, so it's technically a BitLocker bypass, although it doesn't break any crypto. BitLocker can be configured to use either the first approach or the second approach. The second approach is used on many systems by default. As the exploit has shown, if you have serious security requirements, using the first approach is more secure (but do remember to shut down the computer often). [0] For example, in case of TPM, the BitLocker key can also be physically extracted on boot using a logic analyzer to monitor the communication between the host and TPM... Nevertheless, if you can put a security coprocessor into the CPU itself, it can be reasonably secure since key extraction is really difficult, some smartphone's encryption (e.g. iPhone) uses this method.
- deleted 6y ago[deleted]
- paulpauper 6y agothis probably means governments , hackers, etc know many other bypasses
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- lrossi 6y agoI thought this was supposed to encrypt the drive? How can you bypass the lockscreen without having the password? Is the encryption theater?
- my123 6y agoIt's measured boot with the TPM getting measurements of the system state during all steps up to the Windows Boot Manager. (and including the Windows Boot Manager configuration data) If all the measurements match, the TPM releases the volume encryption key and the system can boot. If you boot from an external volume and then modify the boot configuration or the OS loader, or reflash the UEFI firmware, the measurements won't match and the TPM won't give the key. Of course, if the login prompt, which runs way afterwards is buggy, drive encryption in Windows won't save you there. An advantage of this system is that when you reboot, all your services can run before you input your password, and you can login remotely. That's an absolute must for a lot of business use cases.
- zinekeller 6y agoThis is similar to what modern-day smartphones do: they encrypt your data so that it cannot be taken at rest, but assuming that you can hijack the OS you can still read it. Also, BitLocker does have a much more stronger mode where you are actually required to enter a PIN before you reach the regular lock screen that is physically uncrackable*. In other words, this is the state if you have a) done nothing and your device is eligible for automatic encryption or b) you actively selected "TPM Only" despite clear warnings that it will be weaker than PIN. Much more in depth info: https://news.ycombinator.com/item?id=25810639 https://news.ycombinator.com/item?id=25810639 * Unless you have cracked AES
- Xeanort 6y ago* Unless you get an Evil Maid attack [0], like adding a physical keylogger to the keyboard bus. If the device is decrypted but on lock screen (like with TPM) there are more options, the main one is reading memory via DMA [1] on an ExpressCard slot (eg the wifi card). Also swapping out the memory to do a cold boot attack [2] is possible. [0] https://en.wikipedia.org/wiki/Evil_maid_attack https://en.wikipedia.org/wiki/Evil_maid_attack [1] https://github.com/ufrisk/pcileech https://github.com/ufrisk/pcileech [2] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
- zaroth 6y agoI really wish there was video of the entire process start to finish. This part in particular seems like it would be incredibly amusing right before the account gets added; > It is easy to see when the loop is running because the Narrator will move its focus box and say “access denied” every second. This truly is Hollywood style hacking made real.
- jefffoster 6y agoReminds me of how hard it is to write a screensaver by jwz https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://www.jwz.org/blog/2015/04/i-told-you-so-again/ (and follow the links)
- notretarded 6y agohttps://cdn.jwz.org/images/2016/hn.png https://cdn.jwz.org/images/2016/hn.png nice.jpg
- jeroenhd 6y agoUse https://anonym.to/?https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://anonym.to/?https://www.jwz.org/blog/2015/04/i-told-y... or open in a private tab to get past the childish referrer-based redirect.
- varispeed 6y agoI wonder if this was left on purpose for law enforcement or corporate spies and if there are more vulnerabilities like this. Seems like it's better to just stay with good old TC.
- TACIXAT 6y agoThis is not the bitlocker bios pin entry lock screen. That's what I was imagining from the title.
- whatever1 6y agoThere are so many gotchas in computer security. Isn't there a way to verify that a simple algorithm can have only prespecified valid final states (aka {authenticated && allowed login}, {not authenticated && disallowed login})?
- ComputerGuru 6y agoUse a strongly (or stronger-) types language. In C++, use switch blocks instead of if statements, combined with enums (or better yet, enum class) to get exhaustibility checking (warnings at least) from the compiler. More correctly, model the entire thing as a state machine and use strong typing to prevent inadvertent or undesirable code flow changes that bypass the points of entry you are intended to use. But none of that helps here because they purposely added something that escapes the normal control flow for accessibility reasons, and instead of designing it as a part of the locked-down system, they used an escape to load the regular, unauthenticated accessibility apps for reuse.
- whatever1 6y agoBut that is the whole point, they managed to get the system to an undesireable final state {create new user}. The narrator should be part of the validation.
- arkanciscan 6y agoWho leaves sticky keys on?
- fortran77 6y agoI checked--if you have turned 5x-shift sticky keys off, you don't get that window when locked, defeating this exploit. So that would be a good workaround. Many users turn it off!
- deleted 6y ago[deleted]
- resynth1943 6y agoPerfect use-case for Narrator ;-)
- adzm 6y ago> If the application has a manifest, then any .local files are ignored. I suppose this does not hold true for the .local folder named that, apparently? I had not seen it documented before that it looks in that specially crafted dll subfolder (presumably using information from the manifest) to load a dll that is specified in one.
- londons_explore 6y agoThe easiest way to see this is a tool like procmon - you can see every file that anyone tries to access or open. By taking a log of procmon while plugging in a USB device, I'm sure you can find a few things that shouldn't be being accessed... Even when microsoft fixes all their issues, I can bet a bunch of 3rd party apps touch files on external media, and to exploit a locked computer, any third party app running on a users desktop is sufficient too!
- alisaus6 6y agoDo you want hard sex in your city with the best bitch?This way for you - https://adultlove.life https://adultlove.life
- angry_octet 6y agoWhen I realised I had forgotten the bitlocker password on an old Windows disk I did not throw it away, but kept it, knowing this day would come.
- bixxyyy 6y agoThis is not a BitLocker bypass. It's a Windows login screen bypass. The BitLocker login is before Windows ever boots. This describes a system where the user has ALREADY bypassed the BitLocker login and has advanced on to the Windows login screen.
- precommunicator 6y agoIf you have TPM and BitLocker and didn't changed the system settings, bypassing login screen is equal to bypassing BitLocker.
- fundatus 6y agoBTW: You can disable the "I forgot my password" thing completely on the login screen by setting this registry key to 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\NgcPin
- austincheney 6y agoI have only encountered BitLocker on military computers. There BitLocker login occurs before Windows boots, like at the BIOS key entry, and has no options for forgot password.
- You-Are-Right 6y agoAn army that wins wars does not use MS Windows.