4 ms·
The point made earlier was that if you boot Windows, it automatically decrypts the disk, but if you boot from another disk, it doesn't. I don't know much in thi
by cafeinux 3y ago
The point made earlier was that if you boot Windows, it automatically decrypts the disk, but if you boot from another disk, it doesn't.
I don't know much in this, except that I think I know that the TPM has an "owner" and that only that owner can read and modify the content of the TPM.
If you could just plug your USB drive, boot from it and automatically decrypt the Windows partition to edit CMD.exe, I just see this whole Bitlocker and TPM thing as completely moot.
- withinboredom 3y agoI really hate to be the one to point this out, but its clear you didn't read the article since this is exactly what they did: boot windows, steal the key from the TPM, boot into different OS entirely, inject the key to decrypt the disk, replace sethc, reboot into windows and push shift five times ... and there you go.
- cafeinux 3y agoI read the article (and skimmed some parts, as I'm not interested in the technical details of how the signals were decoded). As I understood the conversation thread we're in, we were talking in the context of someone simply booting up the laptop, not someone opening it and plugging wires to tap the TPM bus. Of course, once you've tapped the TPM with the technique described in the article you can do whatever you want with the disk, but in this case I don't see why you would bother bypassing the login, just mount the partition and get the data you need. Edit: specifically in this case, my comment was a reaction to this but from psychphysic : > what does it matter if they sniff the key first? They always had access to the end result of they can boot the laptop => if you didn't sniff the key first, you can't decrypt the disk offline, and can't have access to CMD on the login screen. That's why it matters.