6 ms·

The BitLocker exploit seems simple and very dangerous. Companies and individuals have been relying on BitLocker to protect information if the device is lost. De

• ranger_danger 4mo ago
  How does a bug equate to "not serious about security"?
  • navigate8310 4mo ago
    There's no way this is not a backdoor
    • thewebguyd 4mo ago
      Given that the other two vulns were silently patched, no CVE, basically screams this is a backdoor. If this is a fed mandated backdoor, I guarantee Microsoft/Windows isn't the only one either, they are just the only/first ones to get caught. I'd be suspicious about every single commercial, closed source operating system or encryption product in the US right now.
  • Our_Benefactors 4mo ago
    [flagged]
    • forestry 4mo ago
      *in your opinion.
      • Our_Benefactors 4mo ago
        This is a bad faith comment. Both positions are an opinion.
      • deleted 4mo ago
        [deleted]
    • HDBaseT 4mo ago
      It seems undeniably a backdoor, why on earth would a very specific folder/file name and a specific boot combination just "magically" open up an encrypted drive. It also doesn't help this comes from a person who likely was close to the development at Microsoft (one way or another) as their recent disclosures are quite alarming. Of course, this could technically be the stars aligning type bug, but it seems like a purposefully planted backdoor to me.
      • Dylan16807 4mo ago
        Just booting opens up the encrypted drive. Windows gets the key out of the TPM. Which leaves an enormous attack surface. If you can break Windows before logging in, you can effectively bypass bitlocker. "Windows loads some file in System Volume Information automatically" is not evidence of a backdoor. And you have to put specific exploit files in there to turn this into an attack. You don't just make the folder. It's still possible this is a backdoor, I guess, but there's nothing as blatant as you're implying.
  • forestry 4mo ago
    The blog author calls it that but given there’s no root cause yet it’s foolish to jump to conclusions.
  • Terr_ 4mo ago
    Along with other facets of this, what are the odds a "bug" would also automatically erase evidence of itself from the bootable USB stick when it activates?
    • ranger_danger 4mo ago
      If it's replaying a filesystem transaction like others have said, I can see where it makes sense to erase the files afterwards. You don't want the same transaction replayed twice.
  • JeremyNT 4mo ago
    The basic design of the most common mode of operation for bitlocker, where the TPM hands over the deception keys to the drive when Windows boots without requiring a PIN or anything, indicates how unserious they are.
• cookiengineer 4mo ago
  Note that RedSun and Bluehammer were silently patched, with no response to the CVEs by Microsoft, and not accrediting the researcher's work. That's what this is about. Microsoft doing bad security practices while trying to get away with it, leading to this outcome. The researcher also claims to have another version ready which allows to also bypass TPM+PIN via a similar backdoor, which I'm inclined to believe. Why do I believe that? 5 ring 0 zero days within 3 months are so statistically unlikely to be found, by the same person, in such a short time. Whoever this person is really knows their exploits, and must be in the league of Juan Sacco.
  • aiscoming 4mo ago
    the only way to bypass PIN would be an actual backdoor in Bitlocker. no way around that. an actual backdoor in microsoft encryption was never documented, and there are Snowden documents showing FBI pressing Microsoft into introducing one and Microsoft refusing so I call bullshit on the PIN bypass
    • cookiengineer 4mo ago
      > the only way to bypass PIN would be an actual backdoor in Bitlocker. no way around that. an actual backdoor in microsoft encryption was never documented, and there are Snowden documents showing FBI pressing Microsoft into introducing one and Microsoft refusing A USB stick containing a masterkey to decrypt a bitlocker volume is literally the definition of a backdoor. Go on, try it out. It works.
      • aiscoming 4mo ago
        no, to access a bitlocker volume which automatically decrypts thats an LPE, not an encryption backdoor the USB stick doesnt decrypt bitlocker, it just gives you root after bitlocker was AUTOMATICALLY decrypted
        • cookiengineer 4mo ago
          > no, to access a bitlocker volume which automatically decrypts > thats an LPE, not an encryption backdoor No. RedSun and Bluehammer were LPEs > the USB stick doesnt decrypt bitlocker, it just gives you root after bitlocker was AUTOMATICALLY decrypted No, that's not what the bypass does. Maybe go try it out and verify it before you come to your quickly made conclusions? It's not tied to "automatically decrypted" volumes, whatever that would imply for your setup requiring a pretty pointless TPM keystore for that. If your case were true, it would also imply that any bitlocker cryptography never really worked because it was automatically decryptable without the need for a password/hash/whatever to get your keys from the keystore, which actually makes it so much worse. Even worse than the previously known coldboot attacks.
• londons_explore 4mo ago
  Microsoft has never seemed to treat bitlocker seriously. Back in the windows 7 days you could stick a windows installer CD in and press Shift+F7 or something and get a system command prompt with the drive unlocked. Surely when someone said 'we're gonna let the installer unlock bitlocker' they immediately thought 'That means the whole installer needs to be as secure as the login screen' right? Seemingly not.
  • Imustaskforhelp 4mo ago
    > Back in the windows 7 days you could stick a windows installer CD in and press Shift+F7 or something and get a system command prompt with the drive unlocked. On my birthday iirc once long time ago I think in 5-6th class not sure, my brother gave me his laptop, I wanted to do python but python wanted admin password on windows to install properly. So what I did was I dont even remember how, but download one operating system which could then crack the windows password so that I can set new and I used that to then set a new password to then install python. to then only print hello world :D (I think only because one of the cousins I really admire mentioned that he made 2k loc of python once and I thought during that time, python is the endgame). We are talking about windows 7 but I think that windows 10 security must've gotten better. So these are some things that I have done, I wouldn't call it coding as much as tinkering but I love doing these things from as long as I can remember :D I just remembered this paragraph from one of the comments that I had written sometime ago, source: https://news.ycombinator.com/item?id=47663383 https://news.ycombinator.com/item?id=47663383
  • expedition32 4mo ago
    Seriously enough to make it turned on by default. Which really annoyed me. Desktops don't need encrypted drives.
    • hellojesus 4mo ago
      Why not? Here are some scenarios where you may want protection: - The feds show up - A bugular breaks in and grabs your computer - You're selling your house and host an open house - You have curious children and want to keep them from live booting and reading your tax returns
• stogot 4mo ago
  Third paragraph of the article does make it sound like a simple backdoor planted there
• bri3d 4mo ago
  > What will it take for more companies to truly understand their risks with Windows and being locked into Microsoft’s platforms? What? Most Linux distributions don't even enable FDE by default, and even when they do, they frequently use the exact same system as BitLocker (automated unlock sealed to TPM PCRs) with the exact same vulnerabilities (any signed OS image with a postboot authentication bypass gets you the disk content, as does any method for inspecting the state of system memory). This is an architectural tradeoff you can make on any platform and has nothing to do with "lock in." It's straightforward to configure BitLocker disk encryption to be more secure, but it creates enormous headaches for admins, so they don't do it. I do think that Apple have some better security defaults for FileVault ("enabling" FileVault basically consists of wrapping the existing hardware UID entangled key with the user's password as well) but this strategy does create big issues with remote password rotation or delegated authentication (ie, Active Directory), which is probably why Microsoft don't choose it as a default.
  • ndsipa_pomu 4mo ago
    I've not seen a Linux system using a TPM to unlock encrypted drive(s). When I enable it on laptops etc, I have to manually enter the passphrase.
  • marysol5 4mo ago
    >Most Linux distributions don't even enable FDE by default, and even when they do, they frequently use the exact same system as BitLocker (automated unlock sealed to TPM PCRs) Do they? Any time I've done FDE it's always been luks with a password, I've never seen one go for TPM by default! I've only recently implemented luks+TPM on a personal laptop (and that was a PITA to do).
    • bri3d 4mo ago
      Ubuntu does this with Hardware Backed Encryption option in the installer, which I think they’re trying to move up the list (it’s already the default in Ubuntu Core, which makes sense for that application). I didn’t find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll for my home server, although for anything I use interactively I just use a passphrase instead.