BitLocker Lockscreen Bypass

Re:BitLocker Lockscreen Bypass by zinekeller on Sunday January 17, 2021 @10:12AM (#25811264)

This is similar to what modern-day smartphones do: they encrypt your data so that it cannot be taken at rest, but assuming that you can hijack the OS you can still read it. Also, BitLocker does have a much more stronger mode where you are actually required to enter a PIN before you reach the regular lock screen that is physically uncrackable*. In other words, this is the state if you have a) done nothing and your device is eligible for automatic encryption or b) you actively selected "TPM Only" despite clear warnings that it will be weaker than PIN.

Much more in depth info: https://news.ycombinator.com/item?id=25810639

* Unless you have cracked AES

[ Parent | on HN ]

Re:BitLocker Lockscreen Bypass by Xeanort on Sunday January 17, 2021 @04:55PM (#25815442)

* Unless you get an Evil Maid attack [0], like adding a physical keylogger to the keyboard bus.

If the device is decrypted but on lock screen (like with TPM) there are more options, the main one is reading memory via DMA [1] on an ExpressCard slot (eg the wifi card). Also swapping out the memory to do a cold boot attack [2] is possible.

[0] https://en.wikipedia.org/wiki/Evil_maid_attack

[1] https://github.com/ufrisk/pcileech

[2] https://en.wikipedia.org/wiki/Cold_boot_attack

[ Parent | on HN ]

Re:BitLocker Lockscreen Bypass by zinekeller on Monday January 18, 2021 @06:58PM (#25828250)

Actually, attacks using Thunderbolt PCIe capabilities are too much realistic that it is no longer funny (and it is not just a security bug, its a real feature).

[ Parent | on HN ]