4 ms·
This is a little silly because this assumes that BitLocker is configured for TPM-only rather than requiring a TPM PIN/password. If there's a TPM password, this
by mtlynch 5y ago
This is a little silly because this assumes that BitLocker is configured for TPM-only rather than requiring a TPM PIN/password.
If there's a TPM password, this attack becomes infeasible because the TPM won't release the keys without the password. And you generally can't brute force the TPM without triggering the hardware lockout.
The company's IT department can require TPM+Password in Group Policy so that every system in the organization uses TPM+Password, but I guess you could have a stubborn CEO who demands a less secure policy.
As of Windows 8, it was possible to replace ciphertext on a BitLocker-encrypted drive to compromise known Windows binaries.[0] This would allow the attacker to take control of the system on next boot, though I don't know if those attacks are still practical.
[0] https://cryptoservices.github.io/fde/2014/12/08/code-execution-in-spite-of-bitlocker.html https://cryptoservices.github.io/fde/2014/12/08/code-executi...
- Gargyle 5y agoCan windows do per-user encryption?
- mtlynch 5y agoYes, EFS[0] works on a per-user basis. But it runs at the filesystem level and doesn't protect system binaries, so it's weaker than BitLocker, which encrypts the full volume and protects system binaries. [0] https://en.m.wikipedia.org/wiki/Encrypting_File_System https://en.m.wikipedia.org/wiki/Encrypting_File_System
- sandworm101 5y agoIf someone has this level of access and time with the device, implanting a bug and/or setting up a fake machine shouldn't be difficult. How many here would recognize that Evil Maid has swapped out your work machine with an identical model? It would be rigged to boot into an identical login screen and send your password back to the guy with the real laptop. That's what happens when everyone has the same shiny new machines (Apple). Give me a machine with a few scratches and custom boot screen.
- morpheuskafka 5y agoHuh, this actually raises a very good point. We need a mechanism to verify that the machine itself is legitimate before the user interacts with in. Maybe some sort of QR code containing the current time signed by the TPM that could be verified by the users phone?
- hulitu 5y agoYes, blockchain, with NFT.
- mtlynch 5y agoThat's true, but the victim would immediately recognize something wrong when they boot into their system and find that none of their files are there and they're not connected to their company's VPN. At that point, it's a race between how quickly the attackers can exploit temporary access to the CEO's network resources and how quickly the CEO and their IT folks figure out that they need to cut off the stolen laptop's network access and user credentials.
- 05 5y agoRemote desktop with an HDMI (LVDS?) capture card, so that everything is in place. Alternatively, network mount the SSD once you get the encryption key and boot from that, syncing the blocks on demand. You can even show the 'installing updates' screen to do the HDD sync while it's 'updating'. No wifi connection? no problem - the planted one has an internal 5G modem.
- clipradiowallet 5y agoFor a darker twist... That moment when when the CEO is back in the hotel room, and realizes he just authenticated to a laptop that was not his would be an ideal moment for the assassin that looks very similar to him to exit the hotel bathroom, pop the CEO, dress in his clothes, and proceed to the bank for wire transfer shenanigans.
- SeriousM 5y agoThe logon would look broken or very slow, that's how to get credentials without immediate notice
- baybal2 5y ago> TPM won't release the keys without the password. On the Chinese internets, there are kits exactly for exfiltrating both the PIN, and the key out of TPM chips. Somebody solders them in, then a few month down the line, the intercepted key is either exfiltrated with the device, or remotely over bluetooth.
- nanis 5y ago> I guess you could have a stubborn CEO who demands a less secure policy. More common than one would think. Also, more common than one would hope: CEOs who insist on their favorite MacBookPro which they share with family. :-)
- LinuxBender 5y agoIs Active-Directory GPO a weakness in the chain? Getting engineers to install malware on AD has been proven feasible.
- WelcomeShorty 5y ago> This is a little silly because this assumes that BitLocker is configured for TPM-only rather than requiring a TPM PIN/password. That is how like half the world are doing it. The level of pain to reset the TPM password when 1% of your company forgets their password after each holiday / weekend drinking / password change on Friday / because they're late for a meeting is just too high.
- gpapilion 5y agoUsually security departments are up on this, and often there will be tamper detection enabled on an important executives laptop. I think this is an interesting attack vector, but seems overly complicated especially if you can install a key logger(and probably do it faster).