TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Windows BitLocker – Screwed Without a Screwdriver

190 点作者 lima4 个月前

10 条评论

wat100004 个月前
I can’t understand this design. You should derive the disk’s encryption key from the user’s login password. You have a small, secure program that presents a login screen on boot. It takes the password you input and uses it to unlock the disk. It passes the username and password along to the OS so that it can take you right into your account after it boots.<p>As long as your encryption is decent, this makes it fundamentally impossible to read the drive from a turned-off state without knowing or cracking the password.
评论 #42749363 未加载
评论 #42749627 未加载
评论 #42748913 未加载
评论 #42749200 未加载
评论 #42748921 未加载
评论 #42749670 未加载
评论 #42749004 未加载
评论 #42749156 未加载
评论 #42748981 未加载
layer84 个月前
This is all correct, but it’s been fairly well known since over 15 years ago that BitLocker only really protects a computer if you configure BitLocker to require a pre-boot password, and also only after you turned off the computer [0].<p>[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;BitLocker#TPM_alone_is_not_eno" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;BitLocker#TPM_alone_is_not_eno</a>...
评论 #42752800 未加载
yread4 个月前
&gt; Okay, so now we know how to edit a BCD file. But what do we put in there? This was the trickiest part of this exploit chain, as you get very little feedback when things go wrong. Recall the bug we are trying to reproduce: We want the bootloader to attempt to boot from our BitLocker partition, fail, and then trigger a PXE soft reboot into our controlled OS.<p>&gt; The easiest way to get this working has three parts:<p>&gt; Get the original BCD from the victim’s device. This ensures the configuration matches the specific partition GUIDs. You can do that by shift-rebooting Windows, going “Troubleshoot &gt; Advanced options &gt; Command Prompt”, mounting the boot partition, and copying its contents to a USB drive. Or, be more advanced and use an SMB mount, if you don’t have USB access.<p>Do I understand it correctly that to bypass the encryption you need access to the decrypted contents of the encrypted disk? Did the original exploit guess the layout of the partitions instead?
评论 #42752653 未加载
laurensr4 个月前
Video presentation at <a href="https:&#x2F;&#x2F;ftp.fau.de&#x2F;cdn.media.ccc.de&#x2F;congress&#x2F;2024&#x2F;h264-hd&#x2F;38c3-816-eng-Windows_BitLocker_Screwed_without_a_Screwdriver.mp4" rel="nofollow">https:&#x2F;&#x2F;ftp.fau.de&#x2F;cdn.media.ccc.de&#x2F;congress&#x2F;2024&#x2F;h264-hd&#x2F;38...</a>
kopirgan4 个月前
I had posted this question in another thread re TPM on Linux and the answer is here after a couple of days.
lostmsu4 个月前
This is easily mitigated by requiring password to change boot order.
评论 #42749873 未加载
评论 #42750760 未加载
lostmsu4 个月前
Was BIOS fully updated as well?<p>Do new devices still suffer from the issue?
评论 #42749528 未加载
varispeed4 个月前
How these work on a headless server where you cannot enter password upon boot? If someone steals the server can they read data?
评论 #42749780 未加载
评论 #42749469 未加载
antithesis-nl4 个月前
TL;DR, like all secure-boot disk-encryption outrage-bait articles of late: if you&#x27;re really concerned about any of this, set a TPM PIN and&#x2F;or explicit disk encryption password.
评论 #42749798 未加载
评论 #42749177 未加载
kylebenzle4 个月前
NSA and CIA do NOT want this info to be public. Surprised OP hasn&#x27;t gotten a call yet to shut it down...
评论 #42756814 未加载
评论 #42749228 未加载
评论 #42749340 未加载
评论 #42751810 未加载