Anyway, if you rely on BitLocker in TPM mode (boot without PIN), you should know that anyone can steal your computer, sniff 32 bytes off of the LPC bus, stick them into libbde, and decrypt your disk. Yes, it's that easy. Solder 7 wires to $favorite_fpga_board, decrypt drive.
-
Show this thread
-
-
Replying to @matthew_d_green
BitLocker asks the TPM to unseal the VMK, which gets returned in plaintext over the LPC/SPI bus. Sniff it, feed it into libbde, and you can decrypt the drive.
1 reply 5 retweets 20 likes -
Replying to @marcan42
It doesn’t lock and/or tangle the key with the password? That’s terrible.
1 reply 0 retweets 5 likes -
Replying to @matthew_d_green
This is for no-pin mode. Where it boots all the way to the Windows login screen and that provides the (lack of) security. People keep thinking this mode is secure but it obviously isn't.
3 replies 2 retweets 14 likes -
Replying to @marcan42 @matthew_d_green
Tell me, who believes getting automatically logged in after cold boot is secure? It should be obvious to everyone using #FDE against physical access, that encryption key(s) only protected by the platform means platform can decrypt the disk.
1 reply 1 retweet 2 likes
Lots of people don't understand that there is a difference between typing a password at the BitLocker screen and typing a password at the Windows login screen.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.