6 ms·

What does this have to do with Bitlocker? EDIT: i get it now, it plays a small part in the exploit chain because it doesn't correctly verify what it sets permi

What does this have to do with Bitlocker? EDIT: i get it now, it plays a small part in the exploit chain because it doesn't correctly verify what it sets permissions on when automounting usb drives.

eznzt 6y ago
Nothing, but it sounds more severe if you involve bitlocker somehow.
The_big_unknown 6y ago
There's less need to jump through all these hoops if you have physical access to a PC with enabled USB ports. For example: you could boot from the USB device and access the local storage if it's not encrypted. EDIT: I meant to say "if you have physical access without Bitlocker enabled". Bitlocker is protecting the contents of the storage, if you can bypass the lockscreen on a Bitlocker protected computer you've evaded this protection.
- Speednet 6y ago
  But this article is about bypassing Bitlocker, so that's not relevant. Also, if a system is unencrypted there are a multitude of ways to easily read the contents. That goes for any device or operating system.
  - Jon_Lowtek 6y ago
    The article is about bypassing the Windows Lockscreen, it is not about bypassing Bitlocker.
    - deleted 6y ago
      [deleted]
segfaultbuserr 6y ago
There are two approaches to full disk encryption. The first one is the traditional approach: The encryption is applied independently from the operating system. The key is controlled by the user. The system cannot even boot without the correct key because the underlying hard drive is inaccessible. The disadvantage is the need of entering (very long) keys manually on boot. The second approach, which is popular on phones and tablets, is to use disk encryption transparently, usually with hardware assistance. On boot, the key is automatically filled in by hardware (TPM for BitLocker) when some conditions are met, no passphrase is asked. In this case, the disk encryption employed is not really a "true" encryption [0], instead, it's an extension of operating system's authentication mechanism. BitLocker's sole purpose is to prevent anyone from bypassing the login screen by pulling out the hard drive, rewriting the password, and putting the hard drive back in. It's also why smartphones can be reasonably secure even with a 4-digit PIN. This authentication exploit bypasses the login screen despite BitLocker, so it's technically a BitLocker bypass, although it doesn't break any crypto. BitLocker can be configured to use either the first approach or the second approach. The second approach is used on many systems by default. As the exploit has shown, if you have serious security requirements, using the first approach is more secure (but do remember to shut down the computer often). [0] For example, in case of TPM, the BitLocker key can also be physically extracted on boot using a logic analyzer to monitor the communication between the host and TPM... Nevertheless, if you can put a security coprocessor into the CPU itself, it can be reasonably secure since key extraction is really difficult, some smartphone's encryption (e.g. iPhone) uses this method.
- sdrinf 6y ago
  Heavy bitlocker user here, and up until now assumed the first approach is what's going on; how do I verify which system is used, and switch to the former in a few words? Thanks for the heads-up!
  - segfaultbuserr 6y ago
    > how do I verify which system is used, and switch to the former in a few words? Check whether you are using pre-boot authentication. BitLocker offers true encryption only if pre-boot authentication is used. Here's a tutorial: https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/ https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bi... More information on BitLocker's implementation details and its threat model can be found in Microsoft's documentation [0]. > On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways: > TPM-only. Using TPM-only validation does not require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign in experience is the same as a standard logon. > TPM with startup key. In addition to the protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key. > TPM with PIN. In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN. > TPM with startup key and PIN. In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. TPM-only is the default option, it's better than no security, but arguably insecure (depending on your threat model). TPM with PIN or startup key offers true encryption, they are not vulnerable to this category of attacks. But clearly, using a user-supplied key or PIN has its own disadvantage (which is why TPM-only mode was invented in the first place). > On the other hand, Pre-boot authentication prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization’s support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation. [0] https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures https://docs.microsoft.com/en-us/windows/security/informatio...
tinus_hn 6y ago
Also this bypasses the protection offered by Bitlocker (in the typical ‘keys are stored in the TPM’ setup) as it grants access to the system from the login screen without entering a password. So if you steal a laptop you can get at the drive contents using this trick.
matthewsssy 6y ago
Also, i use another one program, with which you can find out here https://blog.mspy.com/get-7-days-mspy-free https://blog.mspy.com/get-7-days-mspy-free how to track a cell phone location without them knowing easy!
shawnz 6y ago
Agreed, it is wrong to describe this as a Bitlocker bypass. From what I can see it is actually a Windows lock screen bypass and also privilege escalation vulnerability.

What does this have to do with Bitlocker? EDIT: i get it now, it plays a small part in the exploit chain because it doesn't correctly verify what it sets permissions on when automounting usb drives.

eznzt 6y ago

Nothing, but it sounds more severe if you involve bitlocker somehow.

The_big_unknown 6y ago

There's less need to jump through all these hoops if you have physical access to a PC with enabled USB ports. For example: you could boot from the USB device and access the local storage if it's not encrypted. EDIT: I meant to say "if you have physical access without Bitlocker enabled". Bitlocker is protecting the contents of the storage, if you can bypass the lockscreen on a Bitlocker protected computer you've evaded this protection.

Speednet 6y ago
But this article is about bypassing Bitlocker, so that's not relevant. Also, if a system is unencrypted there are a multitude of ways to easily read the contents. That goes for any device or operating system.
- Jon_Lowtek 6y ago
  The article is about bypassing the Windows Lockscreen, it is not about bypassing Bitlocker.
  - deleted 6y ago
    [deleted]

segfaultbuserr 6y ago

There are two approaches to full disk encryption. The first one is the traditional approach: The encryption is applied independently from the operating system. The key is controlled by the user. The system cannot even boot without the correct key because the underlying hard drive is inaccessible. The disadvantage is the need of entering (very long) keys manually on boot. The second approach, which is popular on phones and tablets, is to use disk encryption transparently, usually with hardware assistance. On boot, the key is automatically filled in by hardware (TPM for BitLocker) when some conditions are met, no passphrase is asked. In this case, the disk encryption employed is not really a "true" encryption [0], instead, it's an extension of operating system's authentication mechanism. BitLocker's sole purpose is to prevent anyone from bypassing the login screen by pulling out the hard drive, rewriting the password, and putting the hard drive back in. It's also why smartphones can be reasonably secure even with a 4-digit PIN. This authentication exploit bypasses the login screen despite BitLocker, so it's technically a BitLocker bypass, although it doesn't break any crypto. BitLocker can be configured to use either the first approach or the second approach. The second approach is used on many systems by default. As the exploit has shown, if you have serious security requirements, using the first approach is more secure (but do remember to shut down the computer often). [0] For example, in case of TPM, the BitLocker key can also be physically extracted on boot using a logic analyzer to monitor the communication between the host and TPM... Nevertheless, if you can put a security coprocessor into the CPU itself, it can be reasonably secure since key extraction is really difficult, some smartphone's encryption (e.g. iPhone) uses this method.

sdrinf 6y ago
Heavy bitlocker user here, and up until now assumed the first approach is what's going on; how do I verify which system is used, and switch to the former in a few words? Thanks for the heads-up!
- segfaultbuserr 6y ago
  > how do I verify which system is used, and switch to the former in a few words? Check whether you are using pre-boot authentication. BitLocker offers true encryption only if pre-boot authentication is used. Here's a tutorial: https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/ https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bi... More information on BitLocker's implementation details and its threat model can be found in Microsoft's documentation [0]. > On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways: > TPM-only. Using TPM-only validation does not require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign in experience is the same as a standard logon. > TPM with startup key. In addition to the protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key. > TPM with PIN. In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN. > TPM with startup key and PIN. In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. TPM-only is the default option, it's better than no security, but arguably insecure (depending on your threat model). TPM with PIN or startup key offers true encryption, they are not vulnerable to this category of attacks. But clearly, using a user-supplied key or PIN has its own disadvantage (which is why TPM-only mode was invented in the first place). > On the other hand, Pre-boot authentication prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization’s support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation. [0] https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures https://docs.microsoft.com/en-us/windows/security/informatio...

tinus_hn 6y ago

Also this bypasses the protection offered by Bitlocker (in the typical ‘keys are stored in the TPM’ setup) as it grants access to the system from the login screen without entering a password. So if you steal a laptop you can get at the drive contents using this trick.

matthewsssy 6y ago

Also, i use another one program, with which you can find out here https://blog.mspy.com/get-7-days-mspy-free https://blog.mspy.com/get-7-days-mspy-free how to track a cell phone location without them knowing easy!

shawnz 6y ago

Agreed, it is wrong to describe this as a Bitlocker bypass. From what I can see it is actually a Windows lock screen bypass and also privilege escalation vulnerability.