Locked Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

[dEEpEst]

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop

Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…

 

Architecture of a passwordless BitLocker with a discrete TPM

The BitLocker partition is encrypted using the Full Volume Encryption Key (FVEK). The FVEK itself is encrypted using the Volume Master Key (VMK) and stored on the disk, next to the encrypted data. This permits key rotations without re-encrypting the whole disk.

 

The VMK is stored in the TPM. Thus the disk can only be decrypted when booted from this computer (there is a recovery mechanism in Active Directory though).

In order to decrypt the disk, the CPU will ask that the TPM sends the VMK over the SPI bus.

 

The vulnerability should be obvious: at some point in the boot process, the VMK transits unencrypted between the TPM and the CPU. This means that it can be captured and used to decrypt the disk.

Read more...

This is the hidden content, please

• Sign In
• or
• Sign Up