Order Now!
Windows 7 for XP ProfessionalsUpdating Support Skills from XP to Windows 7by Bink.nu's Raymond Comvalius
There are 74 guest(s) online.
There are 0 member(s) online.
Fraunhofer SIT has presented a method for discovering the BitLocker drive encryption PIN under Windows. The method even works where TPM is used to protect the boot process. The trick? An attacker with access to the target computer simply boots from a USB flash drive and replaces the BitLocker bootloader with a substitute bootloader which mimics the BitLocker PIN query process but saves the PINs entered by the user to disk in unencrypted form.
Although the BitLocker boot process carries out an integrity check on the system, and thereby the Windows installation, it does not check the bootloader itself – not that the actual attack described even gets as far as the Windows boot process. Consequently, according to the Fraunhofer SIT report, even if a Trusted Computing Module (TPM) is fitted, it fails to protect against such an attack.
Once the substitute bootloader has saved the victim's PIN to the hard drive, it rewrites the original bootloader to the MBR and restarts the system. The victim may indeed wonder why their computer is restarting, but then we've all seen computers suddenly decide to abort a boot and restart.
To get hold of the saved PIN, the attacker needs to gain access to the target computer for a second time, to once more boot up from a USB flash drive and then access the hard drive. The computer can then be rebooted and the PIN thus obtained used to open up BitLocker, allowing access to the protected Windows system.
Continue Attack on Windows BitLocker - The H Security News and Features
Download the report: Attacking the BitLocker Boot Process
Video Demo
The "boot from a different OS that can read NTFS and replace files" tactic is never going to be combatted.
However, I am surprised that Windows does not recognize a code change in this important system components, and will either refuse to load it or offer you an option to restore it from DVD.
They could stop this if the bitlocker boot partition doesn't use NTFS but a new totally closed off FS. I think anyways.
And the response from the Windows Team Blog: windowsteamblog.com/.../windows-bitlocker-claims.aspx
This attack vector poses zero risk in the event of burglary or laptop theft, but a coworker or family member who can obtain unmonitored access to your computer is quite another matter. You only need fear those who are closest to you. Happy New Year ;-)