Anyway, if you rely on BitLocker in TPM mode (boot without PIN), you should know that anyone can steal your computer, sniff 32 bytes off of the LPC bus, stick them into libbde, and decrypt your disk. Yes, it's that easy. Solder 7 wires to $favorite_fpga_board, decrypt drive.
-
Show this thread
-
Replying to @marcan42
So I’m still digesting this. Am I understanding this correctly that with TPM only you can sniff the decryption key and therefore decrypt the drive? You may not know the windows password, but wouldn’t need to brute force because you can decrypt the drive and copy out what you want
1 reply 0 retweets 0 likes -
Replying to @blueteamer
Yes. Or just decrypt the drive, use existing tools to remove the Windows password, boot it and log in.
1 reply 0 retweets 0 likes -
Replying to @marcan42
Like booting to nordahl or similar and blanking the local admin pw? With Secure Boot enabled would that work? I spose its a bit of a moot point. Attacker can decrypt drive...
1 reply 0 retweets 0 likes
Secure Boot is irrelevant. Once the drive is decrypted it's decrypted.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.