3 ms·

How does a bug equate to "not serious about security"?

by ranger_danger 6mo ago

navigate8310 6mo ago
There's no way this is not a backdoor
- thewebguyd 5mo ago
  Given that the other two vulns were silently patched, no CVE, basically screams this is a backdoor. If this is a fed mandated backdoor, I guarantee Microsoft/Windows isn't the only one either, they are just the only/first ones to get caught. I'd be suspicious about every single commercial, closed source operating system or encryption product in the US right now.
Our_Benefactors 6mo ago
[flagged]
- forestry 6mo ago
  *in your opinion.
  - Our_Benefactors 6mo ago
    This is a bad faith comment. Both positions are an opinion.
  - deleted 6mo ago
    [deleted]
- HDBaseT 6mo ago
  It seems undeniably a backdoor, why on earth would a very specific folder/file name and a specific boot combination just "magically" open up an encrypted drive. It also doesn't help this comes from a person who likely was close to the development at Microsoft (one way or another) as their recent disclosures are quite alarming. Of course, this could technically be the stars aligning type bug, but it seems like a purposefully planted backdoor to me.
  - Dylan16807 6mo ago
    Just booting opens up the encrypted drive. Windows gets the key out of the TPM. Which leaves an enormous attack surface. If you can break Windows before logging in, you can effectively bypass bitlocker. "Windows loads some file in System Volume Information automatically" is not evidence of a backdoor. And you have to put specific exploit files in there to turn this into an attack. You don't just make the folder. It's still possible this is a backdoor, I guess, but there's nothing as blatant as you're implying.
forestry 6mo ago
The blog author calls it that but given there’s no root cause yet it’s foolish to jump to conclusions.
Terr_ 6mo ago
Along with other facets of this, what are the odds a "bug" would also automatically erase evidence of itself from the bootable USB stick when it activates?
- ranger_danger 6mo ago
  If it's replaying a filesystem transaction like others have said, I can see where it makes sense to erase the files afterwards. You don't want the same transaction replayed twice.
JeremyNT 6mo ago
The basic design of the most common mode of operation for bitlocker, where the TPM hands over the deception keys to the drive when Windows boots without requiring a PIN or anything, indicates how unserious they are.

How does a bug equate to "not serious about security"?

navigate8310 6mo ago

There's no way this is not a backdoor

thewebguyd 5mo ago
Given that the other two vulns were silently patched, no CVE, basically screams this is a backdoor. If this is a fed mandated backdoor, I guarantee Microsoft/Windows isn't the only one either, they are just the only/first ones to get caught. I'd be suspicious about every single commercial, closed source operating system or encryption product in the US right now.

Our_Benefactors 6mo ago

[flagged]

forestry 6mo ago
*in your opinion.
- Our_Benefactors 6mo ago
  This is a bad faith comment. Both positions are an opinion.
- deleted 6mo ago
  [deleted]
HDBaseT 6mo ago
It seems undeniably a backdoor, why on earth would a very specific folder/file name and a specific boot combination just "magically" open up an encrypted drive. It also doesn't help this comes from a person who likely was close to the development at Microsoft (one way or another) as their recent disclosures are quite alarming. Of course, this could technically be the stars aligning type bug, but it seems like a purposefully planted backdoor to me.
- Dylan16807 6mo ago
  Just booting opens up the encrypted drive. Windows gets the key out of the TPM. Which leaves an enormous attack surface. If you can break Windows before logging in, you can effectively bypass bitlocker. "Windows loads some file in System Volume Information automatically" is not evidence of a backdoor. And you have to put specific exploit files in there to turn this into an attack. You don't just make the folder. It's still possible this is a backdoor, I guess, but there's nothing as blatant as you're implying.

forestry 6mo ago

The blog author calls it that but given there’s no root cause yet it’s foolish to jump to conclusions.

Terr_ 6mo ago

Along with other facets of this, what are the odds a "bug" would also automatically erase evidence of itself from the bootable USB stick when it activates?

ranger_danger 6mo ago
If it's replaying a filesystem transaction like others have said, I can see where it makes sense to erase the files afterwards. You don't want the same transaction replayed twice.

JeremyNT 6mo ago

The basic design of the most common mode of operation for bitlocker, where the TPM hands over the deception keys to the drive when Windows boots without requiring a PIN or anything, indicates how unserious they are.