192
Windows 11 BitLocker Bypassed to Extract Encryption Keys
(gbhackers.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 06 Jan 2025
192 points (99.5% liked)
Cybersecurity
5916 readers
150 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 2 years ago
MODERATORS
A "cold boot" attack. These have been around for a while.
The degredation is not a huge barrier. Spraying inverted canned air can cool the DRAM enough to preserve it for a little while, even long enough to switch it to a new motherboard. Whenever the motherboard is powered, the DRAM is being refreshed, so won't degrade. A few bits lost is no fatal flaw, since most cold boot attack algorithms search for long key schedules, not just the key.
Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.
This is not true.
You would additionally need to bypass Secure Boot with a separate exploit such as the one in this article (which is mitigated by disabling USB boot) or LogoFAIL to put the TPM PCRs in a state where the keys can be released.
LUKS2 is no different here as either can be TPM-only or require a separate PIN.
Yes, assuming it's durably sealed and tamper-proof. If you have enough physical access, though, you can remove the DRAM and put it in another machine to scrape it. This adds time, but it has been done before. One experiment dipped the DRAM in liquid nitrogen for an hour, and found 0.13% decay.
Yeah you really need a password or TPM PIN protector to protect from cold boot attacks if that is in your threat model.
What's the advantage of disk encryption if you don't require a password to boot? Couldn't you just boot the device and extract the data using Explorer anyway?
Its kinda useful for devices where userland is also protected against exfil, like a kiosk or windows lock screen.
If the bios is hardened, secure boot on, bitlocker on, and windows is locked with a password, you can't simply take the disk out and manipulate it cause bitlocker with TPM means only that specific hardware profile will decrypt the disk automatically.
You can't get to explorer cause the system is locked with windows auth, and you can't reset the PW cause bitlocker is on, and you cant remove the disk cause the TPM protects against that with bitlocker.
Its really not perfect, and I'm not advocating for it, but its a decent protection in systems where adding another pin/password isn't practical.
Even Microsoft recommends at least also using a pin with bitlocker.
I assume they think the Windows login password will keep them safe. I don't know. But many corporate computers (several I've been forced to use) do use Bitlocker without a password.
Yeah, that's only going to protect from drive theft, which I guess makes disposal easier?
All secure implementations of Bitlocker also use a password on boot. Use of a TPM is not unique to Bitlocker either.