26 ms·

this exploit works only if you dont use a PIN/password for your Bitlocker and the volume automatically unlocks so it gives you access to an encrypted volume wh

this exploit works only if you dont use a PIN/password for your Bitlocker and the volume automatically unlocks so it gives you access to an encrypted volume which automatically unlocks anyway the only difference is that it immediately gives you root access to the volume instead of having to go through the Windows login procedure - this might be a stolen laptop you dont have an account on

ndiddy 4mo ago
The author claims the exploit also works with TPM+PIN, he just hasn't released the PoC: > Second thing is, No, TPM+PIN does not help, the issue is still exploitable regardless, I asked myself this question, can it still work in a TPM+PIN environment ? Yes it does, I'm just not publishing the PoC, I think what's out there is already bad enough. https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-now-huh-also.html https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...
- aiscoming 4mo ago
  they might mean "after you enter the bitlocker PIN you get root access without having a login password on the system" - still just a privilege escalation bug
  - iscoelho 4mo ago
    That’s quite a stretch, to say the least.
    - aiscoming 4mo ago
      claiming to have a 10 times more impressive PoC but not releasing it "out of goodness of heart" is also quite a stretch
      - iscoelho 4mo ago
        Considering the researcher had already reported these to Microsoft, and delayed releasing them publicly until Microsoft "pulled every childish game possible" (quote) instead of patching them, it's not unreasonable for the researcher to be withholding another exploit from the public to limit harm. I also disagree that the PIN bypass would be "10 times more impressive," but that's just my professional opinion.
        ranger_danger 4mo ago
        We know that the PIN method wraps the key in additional layers of encryption, and that the TPM happily returns this wrapped key on boot. So the extra step(s) required would be to bruteforce the PIN and now you can unwrap the plain key. https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ https://post-cyberlabs.github.io/Offensive-security-publicat...
      - sexylinux 4mo ago
        If you think about it for some minutes you will maybe understand that there are many reasons not to publish it.
- JeremyNT 4mo ago
  I'm not a Windows expert but based on my understanding of how MS does this, something doesn't add up here. If you use bitlocker in the default, insecure way, where the TPM is configured to hand the decryption keys over to the enrolled Windows environment automatically, you can just get an LPE to access the running Windows environment after it boots. That's what I think the published exploit does. It really isn't even related to bitlocker itself, right? AIUI, TPM+PIN should actually mean the TPM itself cannot release the keys because the PIN hash is actually part of the key material. So what would a TPM+PIN exploit even look like?
  - panflute 4mo ago
    The usual attack is in a usability feature to prevent lock out. Looking at the instructions for setup I see Bitlocker recovery code if you forget your pin.. (How does that alternative work, what are other alternative unlocks if firmware hash changes, etc, etc..)
  - ranger_danger 4mo ago
    > you can just get an LPE to access the running Windows environment after it boots Or if you have physical access, you can probe the TPM chip with a SPI decoder to get the key directly: https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ https://post-cyberlabs.github.io/Offensive-security-publicat... Another method is via PXE (still not patched on most systems apparently): https://github.com/andigandhi/bitpixie https://github.com/andigandhi/bitpixie > TPM+PIN should actually mean the TPM itself cannot release the keys It does release the (wrapped) key actually (the above cyberlabs link explains it), it's just that the KP data this time has additional layers of encryption that are based on the PIN, which is decrypted in software after the fact. This means you can crack it offline. With the default minimum of 6 digits you can probably bruteforce it within a day. If you're paranoid I might suggest switching to a full password-based pre-boot auth option instead of the PIN.
    - JeremyNT 4mo ago
      Thanks, that fills some gaps I had in understanding. So this person's claim to have a TPM+PIN attack might imply they are able to use the same LPE to get a (PIN-encrypted) key from the TPM then they can simply brute force?

ndiddy 4mo ago

The author claims the exploit also works with TPM+PIN, he just hasn't released the PoC: > Second thing is, No, TPM+PIN does not help, the issue is still exploitable regardless, I asked myself this question, can it still work in a TPM+PIN environment ? Yes it does, I'm just not publishing the PoC, I think what's out there is already bad enough. https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-now-huh-also.html https://deadeclipse666.blogspot.com/2026/05/were-doing-silen...

aiscoming 4mo ago
they might mean "after you enter the bitlocker PIN you get root access without having a login password on the system" - still just a privilege escalation bug
- iscoelho 4mo ago
  That’s quite a stretch, to say the least.
  - aiscoming 4mo ago
    claiming to have a 10 times more impressive PoC but not releasing it "out of goodness of heart" is also quite a stretch
    - iscoelho 4mo ago
      Considering the researcher had already reported these to Microsoft, and delayed releasing them publicly until Microsoft "pulled every childish game possible" (quote) instead of patching them, it's not unreasonable for the researcher to be withholding another exploit from the public to limit harm. I also disagree that the PIN bypass would be "10 times more impressive," but that's just my professional opinion.
      - ranger_danger 4mo ago
        We know that the PIN method wraps the key in additional layers of encryption, and that the TPM happily returns this wrapped key on boot. So the extra step(s) required would be to bruteforce the PIN and now you can unwrap the plain key. https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ https://post-cyberlabs.github.io/Offensive-security-publicat...
    - sexylinux 4mo ago
      If you think about it for some minutes you will maybe understand that there are many reasons not to publish it.
JeremyNT 4mo ago
I'm not a Windows expert but based on my understanding of how MS does this, something doesn't add up here. If you use bitlocker in the default, insecure way, where the TPM is configured to hand the decryption keys over to the enrolled Windows environment automatically, you can just get an LPE to access the running Windows environment after it boots. That's what I think the published exploit does. It really isn't even related to bitlocker itself, right? AIUI, TPM+PIN should actually mean the TPM itself cannot release the keys because the PIN hash is actually part of the key material. So what would a TPM+PIN exploit even look like?
- panflute 4mo ago
  The usual attack is in a usability feature to prevent lock out. Looking at the instructions for setup I see Bitlocker recovery code if you forget your pin.. (How does that alternative work, what are other alternative unlocks if firmware hash changes, etc, etc..)
- ranger_danger 4mo ago
  > you can just get an LPE to access the running Windows environment after it boots Or if you have physical access, you can probe the TPM chip with a SPI decoder to get the key directly: https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ https://post-cyberlabs.github.io/Offensive-security-publicat... Another method is via PXE (still not patched on most systems apparently): https://github.com/andigandhi/bitpixie https://github.com/andigandhi/bitpixie > TPM+PIN should actually mean the TPM itself cannot release the keys It does release the (wrapped) key actually (the above cyberlabs link explains it), it's just that the KP data this time has additional layers of encryption that are based on the PIN, which is decrypted in software after the fact. This means you can crack it offline. With the default minimum of 6 digits you can probably bruteforce it within a day. If you're paranoid I might suggest switching to a full password-based pre-boot auth option instead of the PIN.
  - JeremyNT 4mo ago
    Thanks, that fills some gaps I had in understanding. So this person's claim to have a TPM+PIN attack might imply they are able to use the same LPE to get a (PIN-encrypted) key from the TPM then they can simply brute force?