15 ms·

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

352 points by brohee 3y ago

ballenf 3y ago
Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.
- monocasa 3y ago
  It's shared between a couple of components, but not nearly all of them. These days pretty much just the boot flash and the TPM (and the CPU itself as the bus master) are sitting on that SPI bus.
- psychphysic 3y ago
  The point of this kind of encryption is that a removed hardrive can be sold or repurposed without data risk. Anyone can boot the laptop and get to the decrypted hard drive, what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop.
  - brohee 3y ago
    Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).
    - withinboredom 3y ago
      Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.
      - sznio 3y ago
        If I remember correctly, you needed to replace the accessibility executable with cmd.exe for that to work. Can't do that if the machine is encrypted. And if it's unencrypted there are better ways to reset the passwords.
        gquere 3y ago
        Well that's what I described. The drive was encrypted but there was no PIN so I just snooped the key, decrypted the drive and mounted it on another machine where I replaced sethc with cmd.
      - cafeinux 3y ago
        Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?
        withinboredom 3y ago
        If you can trick the computer into decrypting the disk, why does it matter which disk you actually boot from?
        cafeinux 3y ago
        The point made earlier was that if you boot Windows, it automatically decrypts the disk, but if you boot from another disk, it doesn't. I don't know much in this, except that I think I know that the TPM has an "owner" and that only that owner can read and modify the content of the TPM. If you could just plug your USB drive, boot from it and automatically decrypt the Windows partition to edit CMD.exe, I just see this whole Bitlocker and TPM thing as completely moot.
        withinboredom 3y ago
        I really hate to be the one to point this out, but its clear you didn't read the article since this is exactly what they did: boot windows, steal the key from the TPM, boot into different OS entirely, inject the key to decrypt the disk, replace sethc, reboot into windows and push shift five times ... and there you go.
  - gquere 3y ago
    Can't do this attack if BitLocker is protected by PIN/passphrase, which is rarely the case.
brohee 3y ago
TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
- buran77 3y ago
  > If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary. I always considered that BitLocker without a PIN is 80% convenience and 20% security.
  - yomlica8 3y ago
    IIRC earlier versions of bitlocker would rely upon SSD firmware implementations for drive encryption. They stopped doing that when it was revealed many of these hardware encryption systems in common drives didn't actually work.
    - blibble 3y ago
      void encryptSector(struct context *c, long sector_no, unsigned char *data, size_t data_len) { // TODO }
      - yomlica8 3y ago
        This is also something to keep in mind when resale of SSDs is discussed and people recommend using the secure erase function of the SSD!
        dylan604 3y ago
        It's only securely erased after I've put about six 5/8" holes with my drill in it
        vxNsr 3y ago
        Yup, when I was working desktop support a few years ago my manager told me to just format the drive and send it back to dell at the end of the lease, they’d secure erase it anyway and the data was safe, I never trusted that and used dd to overwrite every bit of the ssd twice with junk data, I’m sure it decreased the longevity of the drive but wasn’t my problem and it felt cool to be the only desktop support guy who knew any Linux.
FirmwareBurner 3y ago
>The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. Errr... no. Using no TPM of any kind decreases your security. The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data. Unencrypted communications over any channel, SW or HW are bad and dTPM never claimed it would protect you from that, but it's still better than no-TPM, and have your keys in system memory or on the disk where it could be accessed through software vulnerabilities. Of course fTPM, is the next step up in security, even though that's also not impenetrable to attackers with the right side channel analysis equipment and expertise, but security threat model is anyway a matter of time and budget of your attackers, nothing can ever be 100% invulnerable to everything.
- candiddevmike 3y ago
  Wouldn't the keys for LUKS/Bitlocker be stored in memory regardless of TPM/no TPM?
- c4mpute 3y ago
  This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME module, and of course vulnerable to those exploits. So overall, I consider fTPM a huge step back, because you might even get access without physical presence. For an fTPM, attack surface is far larger (because all of the ME software), minimum attack complexity may be smaller (because there will one day be a metasploit module for all those software problems, whereas HW hacking is always a certain hurdle), required attacker privileges are less (prolonged unobserved physical presence vs. network). Thus objectively worse in all aspects. What would be better would be a dTPM that is integrated e.g. into a SoC, such that there are no exposed wires anywhere without decapping the SoC. Some systems such as phones work like that, but this is hard to tell even from the technical specs.
jrm4 3y ago
Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.
- FirmwareBurner 3y ago
  >Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers. Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.
  - vladvasiliu 3y ago
    > It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
    - GordonS 3y ago
      IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
      - vladvasiliu 3y ago
        Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
controversial97 3y ago
Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/ https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.
- layer8 3y ago
  It’s good practice to have a copy of the recovery key somewhere.
  - controversial97 3y ago
    Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by connecting it to another machine because the bitlocker key is not available. Yes, people should have backups and copies of their keys but they very commonly don't.
    - Crontab 3y ago
      I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.
      - withinboredom 3y ago
        If you do a volume order, I think you can ask for it to be turned on by default.
      - gambiting 3y ago
        I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.
layer8 3y ago
If you want Bitlocker to protect against someone stealing your laptop, you should be using a password anyway (and disable non-hibernation sleep modes).
- mananaysiempre 3y ago
  The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—why is the key material just strolling along the bus here in plain view? There isn’t even a key exchange protocol or anything.) [1] People are also talking about secure erase here, which, okay, is weaker, but FDE + a EEPROM in a socket that you can pull out and physically destroy does that part just as effectively.
  - vladvasiliu 3y ago
    The windows password is not required for Bitlocker. It doesn't work like macos' filevault. You can configure a dedicated password for bitlocker, or a pin (can be alphanumeric) in addition to the tpm, but there's no link between that and your windows account once the os is booted. I think MS' point about the standard bitlocker setup is that people can't just steal the drive and mount it in their own PC, they need your specific PC. And also, that windows is secure enough that if you have the correct PC with the drive and the OS boots, you can't open the windows session (which by default requires a password). So in this context, bitlocker adds some security while being "transparent".
  - layer8 3y ago
    Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.
als0 3y ago
> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504eaf1be51572b1c0d0d490ac478bc41c64 https://github.com/systemd/systemd/commit/acbb504eaf1be51572...
- comex 3y ago
  This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity somehow, even if this is done in a way that it can’t be worked around just by modifying some files on disk, what stops the attacker from running the same routine in an emulator? I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with.
  - Vogtinator 3y ago
    Agreed. I don't see a way this can be done without one side trusting the other implicitly. If the sniffer/MitM gets either the measured data (to replay) or the unsealed key (to use directly) it's game over. > I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with. fTPMs are basically implemented within (or closely working together with) Intel ME reps. AMD PSP.
  - mjg59 3y ago
    "Authentication" here is something of a misnomer - it's setting up an encrypted session without any proof of identity. In that form it's sufficient to block passive sniffing and require an active MITM instead. The TPM's side of things can be tied back to the EK and hence can be validated against the vendor-issued EK certificate, so in theory this can be implemented in a way that avoids that risk, but that still involves a mechanism for bootstrapping the trust in the EK signing authorities and if that's not in the signed component of the boot chain then you're going to have problems. I'm not sure what you're considering in the emulator case. Either the PCR values are going to be different or the TPM is going to be different, and in both cases that means you're not going to receive the decrypted secret.
ggambetta 3y ago
What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Frequency Shift Keying[0]. What I don't know is what to use to decode this into a stream of bits I can process further (with custom code). [0] https://en.wikipedia.org/wiki/Frequency-shift_keying https://en.wikipedia.org/wiki/Frequency-shift_keying
- Karliss 3y ago
  Pulseview https://github.com/sigrokproject/pulseview https://github.com/sigrokproject/pulseview and probably other parts of Sigrok project https://github.com/sigrokproject https://github.com/sigrokproject . Or since author mentioned DSlogic possibly the corresponding forks of those programs from the company making the logic analyzer.
  - gquere 3y ago
    Indeed I used DSView which is a fork of pulseview.
- aeonik 3y ago
  This is a a major field called Digital Signal Processing, and it's fundamentally what a modem or the ADC in your sound card is doing. I'm not aware of any single algorithm or software that can turn any raw signal to bytes. You need to figure out which modulating scheme the signal uses, and either find a decoder for it, or write your own. Generally it's going to involve filtering, and other mathematical algorithms. But they tend to be pretty short and simple programs for basic decoding. It's a pretty neat skill to learn because you can use the same techniques for all sorts of things. For example, once I learned a bit of DSP it unlocked a lot of abilities with Radio communication, Music and Sound design, image, and video processing.
  - dekhn 3y ago
kosasbest 3y ago
This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a VM typically to use certain software that has no Linux equivalent. I don't trust Bitlocker. Read somewhere Bruce Schneier uses Bitlocker for his daily computing, but I still don't trust it. After all, this is Microsoft we're talking about, who are in cahoots with the NSA, and Redmond has NSA on speed-dial. Avoid Bitlocker if you really want to protect sensitive data. (If you are going to use LUKS, use LUKS2 with a seven word passphrase). Currently this is the state-of-the-art for encrypting disks.
- Already__Taken 3y ago
  luks2 and Tang+Clevis is a pretty tidy solution. I have a host boot that I connect into the VPN and unlock the inner container volumes of code. I would like if it was built upon less shell scripts.
- NoZebra120vClip 3y ago
  Reality check. If US-based Big Tech is undoubtedly pwned by USGov interests, why should you think that non-US-based tech is any different? Do you really think that MI5/6 leaves Canonical alone? Red Hat is IBM and US-based too. Are the Finnish/Scandinavian authorities just patting Linus on the head and saying "do whatever you want bro!" I think that it takes significant leaps of logic, yeah even with pervasive F/OSS, that non-US intelligence is somehow weaker or less interested than US-based ones. In fact, your typical Linux supply chain and SBOM is far, far more complex than anything Windows can serve up. There are so many juicy opportunities in there.
- lostmsu 3y ago
  Fun stuff. I only ever use Linux under Hyper-V precisely because I could not find a reliable way to set up disk encryption that does not ask for password while giving the same protection as Bitlocker (e.g. you can keep your system automatically updated, and as long as your TPM and OS login screen are not vulnerable nobody can steal the machine and decrypt the drives). Even Fedora (which I think is in the better shape than most) does not set that up by default and the only tutorials I found require you to manually reconfigure TPM on every kernel update.
salad-tycoon 3y ago
Deleted
tamimio 3y ago
>The use of a discrete (physical) TPM actually decreases the security My laptop from 2015 didn’t have physical TPM and it prompted me when I tried to enable it: “Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)” and I thought it’s less secure.. the irony! Good thing I don’t use bitlocker anyway.
0xDEF 3y ago
Now that the TPM has been proven to be security theater Microsoft should drop the TPM requirement for Windows 11 and allow older machines to upgrade. My previous job let me keep their 2016 laptop with an Intel i7 CPU, 32 GB RAM, and 512 GB SSD. Wonderful little bedtime laptop that is stuck on Windows 10.
Octabrain 3y ago
I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it will protect my data if my hard disk is extracted from the laptop and attempted to run it from a different system. Worth mentioning that this probably silly misconception is what makes me to always set a password for Bitlocker that I have to type manually which is what I've always done on LUKS. Am I totally wrong?
- Rygian 3y ago
  My guess: if you didn't set a password for the disk encryption, you have no protection for that scenario.
- itscrush 3y ago
  Not entirely wrong, but may be missing how the key is now exportable adding risk to the scenario. As you mention decryption key is provided automatically to the system. This means it's in RAM ready for export and re-use by bad actor against your encrypted disk. Cold boot attacks[1] are one of the attack vectors you'd want to read more on to figure out if this is valid for your threat model. [1] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
- tedunangst 3y ago
  Windows is not supposed to let anyone access the files until they enter the correct account password. So the disk will decrypt in this computer, but then Windows prevents access.
- vel0city 3y ago
  It requires the attacker to bypass the login, extract the key from memory from the system, or potentially with a physical TPM this style of attack. This is probably a lot more sophisticated of an attack than a random thief trying to make a quick buck stealing an expensive computer. Chances are they'll just end up wiping the drive and try to sell it rather than actually try a cold boot attack, but it all depends on your threat profile. Personally I mostly use FDE on personal machines so I don't have to care much about physical destruction when I need to get rid of storage devices. If a hard drive fails I don't need to actually tear it apart to make sure my data is gone. My device is usually in sleep mode when I'm out and about so if they were going to do a cold boot attack they could do it anyways.
jsmith99 3y ago
There's nothing new in this. The default configuration doesn't require a PIN but the Microsoft documentation explains the various attacks and recommends setting a Bitlocker PIN which completely prevents this. The PIN can be quite weak because the TPM prevents brute forcing. See eg https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures https://learn.microsoft.com/en-us/windows/security/operating...
- kotaKat 3y ago
  Also amusingly, as far as I'm aware, Windows Defender now by default blocks any accessibility-based escalation attacks -- Behavior:Win32/AccessibilityEscalation.
- allset_ 3y ago
  I would expect the TPM to wipe key material after X failed attempts, is that not the case?
kristjank 3y ago
I find the fact that the old elementary school trick of renaming Command prompt to the accessibility handler still works as well as it used to in the Windows Vista days incredibly funny. You would imagine Windows would authenticate something that runs with admin perms with no login required. Windows seems to be 75% security theather and about 25% other types of theather.
pgraf 3y ago
Same technique described in 2021: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...
temptemptemp111 3y ago
[dead]
abdulheycoban 3y ago
could anyone tell me that what if (actually is) i dont have tpm on my pc? would it be risky for these attacks? i configured bitlocker without tpm.

352 points by brohee 3y ago

Since the key traverses the shared bus, does that mean that every component in the system could intercept the key just as easily as this logic analyzer does? Sounds like a supply chain security nightmare.

monocasa 3y ago
It's shared between a couple of components, but not nearly all of them. These days pretty much just the boot flash and the TPM (and the CPU itself as the bus master) are sitting on that SPI bus.
psychphysic 3y ago
The point of this kind of encryption is that a removed hardrive can be sold or repurposed without data risk. Anyone can boot the laptop and get to the decrypted hard drive, what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop.
- brohee 3y ago
  Well you will boot the laptop but still have to get past the login screen. Intercepting the key permits to read/write whatever you want on the disk, and thus backdoor the OS (as he does).
  - withinboredom 3y ago
    Dude. Bypassing the login screen is as simple as pressing shift five times. That’s like some kindergarten stuff.
    - sznio 3y ago
      If I remember correctly, you needed to replace the accessibility executable with cmd.exe for that to work. Can't do that if the machine is encrypted. And if it's unencrypted there are better ways to reset the passwords.
      - gquere 3y ago
        Well that's what I described. The drive was encrypted but there was no PIN so I just snooped the key, decrypted the drive and mounted it on another machine where I replaced sethc with cmd.
    - cafeinux 3y ago
      Doesn't this method imply booting from an external disk, thus not decrypting the HDD, thus not being able to modify what needs to be modified in order to bypass the login screen?
      - withinboredom 3y ago
        If you can trick the computer into decrypting the disk, why does it matter which disk you actually boot from?
        cafeinux 3y ago
        The point made earlier was that if you boot Windows, it automatically decrypts the disk, but if you boot from another disk, it doesn't. I don't know much in this, except that I think I know that the TPM has an "owner" and that only that owner can read and modify the content of the TPM. If you could just plug your USB drive, boot from it and automatically decrypt the Windows partition to edit CMD.exe, I just see this whole Bitlocker and TPM thing as completely moot.
        withinboredom 3y ago
        I really hate to be the one to point this out, but its clear you didn't read the article since this is exactly what they did: boot windows, steal the key from the TPM, boot into different OS entirely, inject the key to decrypt the disk, replace sethc, reboot into windows and push shift five times ... and there you go.
- gquere 3y ago
  Can't do this attack if BitLocker is protected by PIN/passphrase, which is rarely the case.

brohee 3y ago

TLDR if you actually want to act upon that : Takeaways The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.

buran77 3y ago
> If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary. I always considered that BitLocker without a PIN is 80% convenience and 20% security.
- yomlica8 3y ago
  IIRC earlier versions of bitlocker would rely upon SSD firmware implementations for drive encryption. They stopped doing that when it was revealed many of these hardware encryption systems in common drives didn't actually work.
  - blibble 3y ago
    void encryptSector(struct context *c, long sector_no, unsigned char *data, size_t data_len) { // TODO }
    - yomlica8 3y ago
      This is also something to keep in mind when resale of SSDs is discussed and people recommend using the secure erase function of the SSD!
      - dylan604 3y ago
        It's only securely erased after I've put about six 5/8" holes with my drill in it
      - vxNsr 3y ago
        Yup, when I was working desktop support a few years ago my manager told me to just format the drive and send it back to dell at the end of the lease, they’d secure erase it anyway and the data was safe, I never trusted that and used dd to overwrite every bit of the ssd twice with junk data, I’m sure it decreased the longevity of the drive but wasn’t my problem and it felt cool to be the only desktop support guy who knew any Linux.

FirmwareBurner 3y ago

>The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem. Errr... no. Using no TPM of any kind decreases your security. The discrete TPM's threat model was never designed to cover you from attackers using oscilloscope to probe your laptop's SPI bus during the boot process for unencrypted data. Unencrypted communications over any channel, SW or HW are bad and dTPM never claimed it would protect you from that, but it's still better than no-TPM, and have your keys in system memory or on the disk where it could be accessed through software vulnerabilities. Of course fTPM, is the next step up in security, even though that's also not impenetrable to attackers with the right side channel analysis equipment and expertise, but security threat model is anyway a matter of time and budget of your attackers, nothing can ever be 100% invulnerable to everything.

candiddevmike 3y ago
Wouldn't the keys for LUKS/Bitlocker be stored in memory regardless of TPM/no TPM?
c4mpute 3y ago
This is highly misleading. fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME module, and of course vulnerable to those exploits. So overall, I consider fTPM a huge step back, because you might even get access without physical presence. For an fTPM, attack surface is far larger (because all of the ME software), minimum attack complexity may be smaller (because there will one day be a metasploit module for all those software problems, whereas HW hacking is always a certain hurdle), required attacker privileges are less (prolonged unobserved physical presence vs. network). Thus objectively worse in all aspects. What would be better would be a dTPM that is integrated e.g. into a SoC, such that there are no exposed wires anywhere without decapping the SoC. Some systems such as phones work like that, but this is hard to tell even from the technical specs.

jrm4 3y ago

Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.

FirmwareBurner 3y ago
>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers. Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.
- vladvasiliu 3y ago
  > It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
  - GordonS 3y ago
    IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
    - vladvasiliu 3y ago
      Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.

controversial97 3y ago

Another write up from 2021 https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/ https://arstechnica.com/gadgets/2021/08/how-to-go-from-stole... One aspect of this is that some laptop manufacturers provide a setting to erase the TPM if the laptop is opened. You opened that laptop to see if you can add more RAM? Better hope you can access the bitlocker key or have a good backup.

layer8 3y ago
It’s good practice to have a copy of the recovery key somewhere.
- controversial97 3y ago
  Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker. People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by connecting it to another machine because the bitlocker key is not available. Yes, people should have backups and copies of their keys but they very commonly don't.
  - Crontab 3y ago
    I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.
    - withinboredom 3y ago
      If you do a volume order, I think you can ask for it to be turned on by default.
    - gambiting 3y ago
      I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

layer8 3y ago

If you want Bitlocker to protect against someone stealing your laptop, you should be using a password anyway (and disable non-hibernation sleep modes).

mananaysiempre 3y ago
The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—why is the key material just strolling along the bus here in plain view? There isn’t even a key exchange protocol or anything.) [1] People are also talking about secure erase here, which, okay, is weaker, but FDE + a EEPROM in a socket that you can pull out and physically destroy does that part just as effectively.
- vladvasiliu 3y ago
  The windows password is not required for Bitlocker. It doesn't work like macos' filevault. You can configure a dedicated password for bitlocker, or a pin (can be alphanumeric) in addition to the tpm, but there's no link between that and your windows account once the os is booted. I think MS' point about the standard bitlocker setup is that people can't just steal the drive and mount it in their own PC, they need your specific PC. And also, that windows is secure enough that if you have the correct PC with the drive and the OS boots, you can't open the windows session (which by default requires a password). So in this context, bitlocker adds some security while being "transparent".
- layer8 3y ago
  Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.

als0 3y ago

> using a fTPM would solve the problem. All TPMs support encrypted sessions to prevent these kind of MITM attacks. You use TPM2_StartAuthSession and specify encryption with each session command. But Bitlocker doesn't use one, which is epic fail. Microsoft need to fix it. Edit: For comparison, systemd uses encrypted sessions when using LUKS disk encryption with the TPM https://github.com/systemd/systemd/commit/acbb504eaf1be51572b1c0d0d490ac478bc41c64 https://github.com/systemd/systemd/commit/acbb504eaf1be51572...

comex 3y ago
This isn’t even a proper MitM attack, just passive sniffing. But, I ask as someone unfamiliar with TPM, how do authenticated sessions work? How does the OS prove its identity to the TPM in a way an attacker couldn’t spoof in a real MitM attack? Any secrets or keys stored by the OS side would have to reside unencrypted on disk, since it doesn’t have an encryption key yet. Or even if the OS verifies the TPM’s identity somehow, even if this is done in a way that it can’t be worked around just by modifying some files on disk, what stops the attacker from running the same routine in an emulator? I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with.
- Vogtinator 3y ago
  Agreed. I don't see a way this can be done without one side trusting the other implicitly. If the sniffer/MitM gets either the measured data (to replay) or the unsealed key (to use directly) it's game over. > I don’t see how you get real security from this approach unless there’s some integration with Intel ME or SGX or other CPU-side ‘secure’ environments, but then you wouldn’t need the TPM to start with. fTPMs are basically implemented within (or closely working together with) Intel ME reps. AMD PSP.
- mjg59 3y ago
  "Authentication" here is something of a misnomer - it's setting up an encrypted session without any proof of identity. In that form it's sufficient to block passive sniffing and require an active MITM instead. The TPM's side of things can be tied back to the EK and hence can be validated against the vendor-issued EK certificate, so in theory this can be implemented in a way that avoids that risk, but that still involves a mechanism for bootstrapping the trust in the EK signing authorities and if that's not in the signed component of the boot chain then you're going to have problems. I'm not sure what you're considering in the emulator case. Either the PCR values are going to be different or the TPM is going to be different, and in both cases that means you're not going to receive the decrypted secret.

ggambetta 3y ago

What software was used to turn the raw signal into zeros and ones? I've had a similar project since forever (reading digital data off 80s-era cassette tapes), I have pretty good .wav versions of the tapes, but I haven't found the right tool (or library) to turn it into zeros and ones :( Of course the fun part will begin once I can start decoding the zeros and ones... EDIT: I know how the bits are encoded, it's Frequency Shift Keying[0]. What I don't know is what to use to decode this into a stream of bits I can process further (with custom code). [0] https://en.wikipedia.org/wiki/Frequency-shift_keying https://en.wikipedia.org/wiki/Frequency-shift_keying

Karliss 3y ago
Pulseview https://github.com/sigrokproject/pulseview https://github.com/sigrokproject/pulseview and probably other parts of Sigrok project https://github.com/sigrokproject https://github.com/sigrokproject . Or since author mentioned DSlogic possibly the corresponding forks of those programs from the company making the logic analyzer.
- gquere 3y ago
  Indeed I used DSView which is a fork of pulseview.
aeonik 3y ago
This is a a major field called Digital Signal Processing, and it's fundamentally what a modem or the ADC in your sound card is doing. I'm not aware of any single algorithm or software that can turn any raw signal to bytes. You need to figure out which modulating scheme the signal uses, and either find a decoder for it, or write your own. Generally it's going to involve filtering, and other mathematical algorithms. But they tend to be pretty short and simple programs for basic decoding. It's a pretty neat skill to learn because you can use the same techniques for all sorts of things. For example, once I learned a bit of DSP it unlocked a lot of abilities with Radio communication, Music and Sound design, image, and video processing.
- dekhn 3y ago

kosasbest 3y ago

This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a VM typically to use certain software that has no Linux equivalent. I don't trust Bitlocker. Read somewhere Bruce Schneier uses Bitlocker for his daily computing, but I still don't trust it. After all, this is Microsoft we're talking about, who are in cahoots with the NSA, and Redmond has NSA on speed-dial. Avoid Bitlocker if you really want to protect sensitive data. (If you are going to use LUKS, use LUKS2 with a seven word passphrase). Currently this is the state-of-the-art for encrypting disks.

Already__Taken 3y ago
luks2 and Tang+Clevis is a pretty tidy solution. I have a host boot that I connect into the VPN and unlock the inner container volumes of code. I would like if it was built upon less shell scripts.
NoZebra120vClip 3y ago
Reality check. If US-based Big Tech is undoubtedly pwned by USGov interests, why should you think that non-US-based tech is any different? Do you really think that MI5/6 leaves Canonical alone? Red Hat is IBM and US-based too. Are the Finnish/Scandinavian authorities just patting Linus on the head and saying "do whatever you want bro!" I think that it takes significant leaps of logic, yeah even with pervasive F/OSS, that non-US intelligence is somehow weaker or less interested than US-based ones. In fact, your typical Linux supply chain and SBOM is far, far more complex than anything Windows can serve up. There are so many juicy opportunities in there.
lostmsu 3y ago
Fun stuff. I only ever use Linux under Hyper-V precisely because I could not find a reliable way to set up disk encryption that does not ask for password while giving the same protection as Bitlocker (e.g. you can keep your system automatically updated, and as long as your TPM and OS login screen are not vulnerable nobody can steal the machine and decrypt the drives). Even Fedora (which I think is in the better shape than most) does not set that up by default and the only tutorials I found require you to manually reconfigure TPM on every kernel update.

salad-tycoon 3y ago

Deleted

tamimio 3y ago

>The use of a discrete (physical) TPM actually decreases the security My laptop from 2015 didn’t have physical TPM and it prompted me when I tried to enable it: “Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)” and I thought it’s less secure.. the irony! Good thing I don’t use bitlocker anyway.

0xDEF 3y ago

Now that the TPM has been proven to be security theater Microsoft should drop the TPM requirement for Windows 11 and allow older machines to upgrade. My previous job let me keep their 2016 laptop with an Intel i7 CPU, 32 GB RAM, and 512 GB SSD. Wonderful little bedtime laptop that is stuck on Windows 10.

Octabrain 3y ago

I would like to take the chance to ask about something that I never understood from Bitlocker and this kind of encryption, in general, where the decryption key is provided automatically by the system. Let's say, if my laptop (I mean, the whole device) is stolen, which security does Bitlocker provide? From an attacker POV, the system will boot and it will ask for my user account password. So, to my understanding, it will protect my data if my hard disk is extracted from the laptop and attempted to run it from a different system. Worth mentioning that this probably silly misconception is what makes me to always set a password for Bitlocker that I have to type manually which is what I've always done on LUKS. Am I totally wrong?

Rygian 3y ago
My guess: if you didn't set a password for the disk encryption, you have no protection for that scenario.
itscrush 3y ago
Not entirely wrong, but may be missing how the key is now exportable adding risk to the scenario. As you mention decryption key is provided automatically to the system. This means it's in RAM ready for export and re-use by bad actor against your encrypted disk. Cold boot attacks[1] are one of the attack vectors you'd want to read more on to figure out if this is valid for your threat model. [1] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
tedunangst 3y ago
Windows is not supposed to let anyone access the files until they enter the correct account password. So the disk will decrypt in this computer, but then Windows prevents access.
vel0city 3y ago
It requires the attacker to bypass the login, extract the key from memory from the system, or potentially with a physical TPM this style of attack. This is probably a lot more sophisticated of an attack than a random thief trying to make a quick buck stealing an expensive computer. Chances are they'll just end up wiping the drive and try to sell it rather than actually try a cold boot attack, but it all depends on your threat profile. Personally I mostly use FDE on personal machines so I don't have to care much about physical destruction when I need to get rid of storage devices. If a hard drive fails I don't need to actually tear it apart to make sure my data is gone. My device is usually in sleep mode when I'm out and about so if they were going to do a cold boot attack they could do it anyways.

jsmith99 3y ago

There's nothing new in this. The default configuration doesn't require a PIN but the Microsoft documentation explains the various attacks and recommends setting a Bitlocker PIN which completely prevents this. The PIN can be quite weak because the TPM prevents brute forcing. See eg https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures https://learn.microsoft.com/en-us/windows/security/operating...

kotaKat 3y ago
Also amusingly, as far as I'm aware, Windows Defender now by default blocks any accessibility-based escalation attacks -- Behavior:Win32/AccessibilityEscalation.
allset_ 3y ago
I would expect the TPM to wipe key material after X failed attempts, is that not the case?

kristjank 3y ago

I find the fact that the old elementary school trick of renaming Command prompt to the accessibility handler still works as well as it used to in the Windows Vista days incredibly funny. You would imagine Windows would authenticate something that runs with admin perms with no login required. Windows seems to be 75% security theather and about 25% other types of theather.

pgraf 3y ago

Same technique described in 2021: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...

temptemptemp111 3y ago

[dead]

abdulheycoban 3y ago

could anyone tell me that what if (actually is) i dont have tpm on my pc? would it be risky for these attacks? i configured bitlocker without tpm.