TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]

111 点作者 tkems超过 1 年前

13 条评论

aquova超过 1 年前
Very interesting video. For those who can&#x27;t watch, he creates a PCB with a RPi Pico and some data pins which can sniff the BitLocker key as it&#x27;s sent from the TPM chip back to the CPU. I was surprised to see that this was sent in plaintext, so although his board probably will only work for that particular motherboard, the method would be sound for other computers as well.<p>I&#x27;ll leave the comments about MS requiring TPM chips for Win11 to others.
评论 #39245030 未加载
评论 #39245492 未加载
briHass超过 1 年前
No big deal here. This attack looks like it&#x27;s using a crusty old TPM 1.2 laptop, so encrypted parameters to the TPM aren&#x27;t supported. Even with Win11 and TPM2.0 (required for Win11), encrypted parameters to the TPM would just slow down an attacker.<p>You need to use pre-boot auth, like a PIN. Obviously, the TPM needs to have some kind of authentication to release the key, not just the default mode where Windows just needs to request it. This is all outlined in MS documentation: <a href="https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;security&#x2F;operating-system-security&#x2F;data-protection&#x2F;bitlocker&#x2F;countermeasures#attacker-with-skill-and-lengthy-physical-access" rel="nofollow">https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;security&#x2F;operating...</a>
评论 #39246994 未加载
评论 #39248929 未加载
评论 #39248820 未加载
osy超过 1 年前
TPM is insecure against physical attacks by design: <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;osy&#x2F;45e612345376a65c56d0678834535166" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;osy&#x2F;45e612345376a65c56d0678834535166</a><p>The only secure implementation is called D-RTM which requires a level of chip, OEM, and OS support that&#x27;s not done in practice.
评论 #39245295 未加载
评论 #39245059 未加载
评论 #39245154 未加载
评论 #39290736 未加载
评论 #39245014 未加载
jsmith99超过 1 年前
Nothing new. This attack is demonstrated here many times and the Microsoft docs discuss a similar attack using self encrypting drives. The counter measure is to use a virtual TPM built into the CPU or to use TPM+PIN (which is standard practice for security).
评论 #39245525 未加载
jpalomaki超过 1 年前
Does Microsoft Pluton [1] help here? I noticed at least some recent ThinkPad AMD models support it.<p>[1] <a href="https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;security&#x2F;hardware-security&#x2F;pluton&#x2F;microsoft-pluton-security-processor" rel="nofollow">https:&#x2F;&#x2F;learn.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;security&#x2F;hardware-...</a>
评论 #39245663 未加载
matsz超过 1 年前
This is particularly interesting considering that TrueCrypt recommended migration to BitLocker as the main option for Windows: <a href="https:&#x2F;&#x2F;truecrypt.sourceforge.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;truecrypt.sourceforge.net&#x2F;</a><p>IIRC Apple&#x27;s version of TPM (Secure Enclave) should be immune to such attacks (since it&#x27;s on the SoC, but I&#x27;m not sure whether the communication is encrypted or not), and the main data encryption method for GNU&#x2F;Linux (LUKS) does not utilize TPM by default (might depend on distro though).<p>EDIT: I believe that the method in the video only works for volumes that aren&#x27;t password&#x2F;PIN-protected.
评论 #39244662 未加载
评论 #39245517 未加载
linarism超过 1 年前
Worth noting that modern AMD CPUs incorporate the TPM functionality in the CPU itself, not sure about Intel.
评论 #39244615 未加载
评论 #39244645 未加载
kopirgan超过 1 年前
Didn&#x27;t know! After TC vanished with recommendation to use BL I had kept few files in direct Windows storage protected by BL. The more sensitive ones I still kept in Vera. Here my natural scepticism protected me lol.<p>Guess turning on pre boot pw is next thing to do.
评论 #39247277 未加载
bugbuddy超过 1 年前
I predict that this will necessitate an upgrade to TPM 3.0 with a key exchange handshake mitigation along with it being a requirement to upgrade to Windows 12. That’s fine though because it will help with economic growth and all the relevant companies’ bottom lines.
评论 #39245532 未加载
whyoh超过 1 年前
To decrypt a drive with a <i>TPM-only</i> key you just need to <i>turn on the PC</i>. So what&#x27;s the big deal here?<p>It&#x27;s disappointing that TPM-only is the <i>default</i> for Bitlocker, but you can just use something else (pin&#x2F;password, key file, ...).
评论 #39245761 未加载
评论 #39244990 未加载
评论 #39249433 未加载
评论 #39246558 未加载
Dowwie超过 1 年前
This presumably applies to any FDE utilizing TPM, not just BitLocker.
WirelessGigabit超过 1 年前
Modern systems don&#x27;t have a dedicated TPM, so it&#x27;s a lot harder to read the settings off the chip, as it is part of the CPU.<p>Then I believe modern TPM communication is encrypted.<p>On too of that you want your laptop to support physical tampering resistance, which prevents both this (outdated) chip attack and freezing the RAM. When you then boot the laptop the master password is required. I would prefer it to throw off the PCR but hey, it works too.<p>I do wonder if you have 8GB of soldered RAM and 8GB on a stick, Windows keeps the key in the soldered part to increase difficulty stealing?
joemazerino超过 1 年前
I&#x27;m lead to believe the TPM is a firmware TPM and not a hardware one. Is this correct?
评论 #39245901 未加载