6 ms·
Raspberry Pi Pico cracks BitLocker in under a minute
- stillbourne 3y agoI saw this on hackaday 43 seconds to crack bitlocker is pretty badass.
- __egb__ 3y agoAnd the first 30 seconds was just unscrewing the base.
- gnabgib 3y agoPrevious discussions: "Breaking Bitlocker – Bypassing the Windows Disk Encryption [video]"[0](110 points, 3 days ago, 68 comments), "BitLocker encryption broken in 43 seconds with sub-$10 Raspberry Pi Pico"[1] (108 points, 11 hours ago, 62 comments) [0]: https://news.ycombinator.com/item?id=39243305 https://news.ycombinator.com/item?id=39243305 [1]: https://news.ycombinator.com/item?id=39284711 https://news.ycombinator.com/item?id=39284711
- jvanderbot 3y agoTFA: > If your hardware is vulnerable, mitigation can be achieved through the use of a PIN. Or, encryption passphrase on boot. But in that case, you just need two accesses: Add h/w keylogger, read h/w keylogger. You can at least make it somewhat more difficult by using ubsguard to prevent the most obvious keylogger ingress points.
- maxcoder4 3y agoAnd the usbguard must be installed in the initramfs, not the main system, right? Because the fde password is provided before most of the system loads.
- jvanderbot 3y agoI'm not sure. I know I've been unable to enter my encryption pass word because I had a new keyboard
- buran77 3y agoAm I missing something or is this the same TPM bus sniffing for the key exchange attack (from @marcan maybe?) that was detailed some years back but using a cheap Pi? Is this attack BitLocker specific somehow? It looks like it would affect LUKS or others just as well. Just trying to understand the novelty of this particular method or if it's tied to BitLocker in particular. Anyway, not to detract from the nice work of the author or to tout my own horn but I can hack a lot of encryptions in seconds with a simple keylogger. For the sake of this exercise I'll consider the key exchange (user typing password) is an integral part of any encryption scheme :). More seriously, I think fTPM or TPM+PIN+USB key would be good ways to avoid this scenario.
- nullindividual 3y agoThis impacts any encryption scheme using dTPM, which today should be uncommon as fTPM has been in AMD and Intel chips for many years.
- p_l 3y agoIt also impacts only dTPM use that does not set up encrypted session first. No idea why Bitlocker doesn't use encrypted session.
- soraminazuki 3y ago> It looks like it would affect LUKS or others just as well. Except you can use good old password protected FDE on any major desktop operating system other than Windows Home Edition. > I can hack a lot of encryptions in seconds with a simple keylogger. A thief can't use your keylogger to decrypt a stolen laptop that's properly encrypted. A rogue recycling shop can't do that either. And kids won't be able to use, uh, Raspberry Pis to decrypt random Surface laptops. So yes, it's kind of a big deal. People shouldn't have to worry about the TPM details of their devices to benefit from encryption in ways that protect against the most common threats.
- MikusR 3y agoVeraCrypt works on Windows Home
- iLoveOncall 3y agoI'm not familiar at all with this kind of low-level knowledge so probably a stupid question but: does that require the device to be connected when the user types their password to actually retrieve the key, or is it an actual "crack" as in it can unlock BitLocker without key nor password ever being inputted on the device?
- bri3d 3y agoIt only works with Bitlocker which relies only on external/discrete (dTPM) key material and no configured PIN or password, so there is nothing to input. It’s just sniffing key material off of the external TPM bus after the bootloader asks for it. This is an ancient attack and not very technically interesting, but it comes up every few years because Microsoft still don’t switch to using TPM encrypted sessions.
- vel0city 3y agoThis is for non-password Bitlocker with discrete TPMs that aren't configured to encrypt their exchange. There's a mode of Bitlocker where it boots into a basic boot environment, asks the TPM for the key, the TPM validates the environment, and then gives the decryption key. For some discrete TPMs, this last step of the TPM giving the key to the boot environment is done in the clear and can be sniffed.
- realo 3y agoThis particular bus sniffing attack is easily prevented... it's just that Microsoft _chose_ to avoid implementing the protection. Mission critical embedded devices are not designed by Microsoft, and would normally have tpm parameter encryption... https://security.stackexchange.com/questions/253776/why-does-windows-not-enable-tpm-2-0-parameter-encryption-to-protect-against-bus https://security.stackexchange.com/questions/253776/why-does...
- orev 3y agoImpressive technical feat, even if not completely new. However, as tech people we need to stop downplaying our accomplishments. “43 seconds” (plus the lifetime of learning that allowed them to figure out how to do all these things: decoding the wire signals, writing a custom firmware, knowing how to probe the motherboard for the correct signals, etc.)
- woodrowbarlow 3y ago43 seconds is the time taken to deploy the exploit, not to develop it. the short time window communicates the severity of the exploit.
- Bluescreenbuddy 3y agoOh no there goes all the windows 8 lenovos.
- kramerger 3y agoRemember when Microsoft told you you can't have Windows 11 because of your missing/old TPM wouldn't be secure enough? Turns out it's all security theater.
- yellowapple 3y agoSome prior art: https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...