Hack, Make & Break
Windows BitLocker: Screwed without a Screwdriver
Ever wondered how Cellebrite and law enforcement gain access to encrypted devices without knowing the password? In this talk, we’ll demonstrate how to bypass BitLocker encryption on a fully up-to-date Windows 11 system using Secure Boot. We’ll leverage a little-known software vulnerability that Microsoft has been unable to patch since 2022: bitpixie (CVE-2023-21563).
We'll live-demo the exploit, and will walk through the entire process—from the prerequisites and inner workings of the exploit to why Microsoft has struggled to address this flaw. We'll also discuss how to protect yourself from this and similar vulnerabilities.
BitLocker is Microsoft’s implementation of full-volume encryption. It offers several modes of operation, but the most widely used is Secure Boot-based encryption.
Many consumer and corporate clients use it, and it’s starting to be enabled by default under "Device Encryption" on newer Windows 11 installations.
In this mode, the harddrive is encrypted at rest but is automatically unsealed when a legit windows boots, meaning users don't need a separate decryption password. They just have to sign in with their usual user account.
Unfortunately, this configuration has been broken for quite a while. Hardware attacks against a dTPM are widely known, but software attacks are possible as well, at least since 2022, when Rairii discovered the bitpixie bug (CVE-2023-21563).
While this bug is 'fixed' since Nov. 2022 and publically known since 2023, we can still use it today with a downgrade attack to decrypt BitLocker.
In this talk, we'll dive into:
- How does Secure Boot work, and what role does the TPM play?
- How can Bitlocker leverage the TPM?
- How does the bitpixie exploit work? What are PXE boot and BCD?
- What are the prerequisites for running this exploit?
- How can you protect yourself against it?
- Why is it so challenging for Microsoft to fully fix this?
- How does this affect Linux secure boot?
Additional information
| Type | Talk 60 (45min +15 Q&A) |
|---|---|
| Language | English |
More sessions
| 12/27/24 |
Exploring the security of the new iPhone Mirroring feature as well as the current threat model of the iOS ecosystem
|
| 12/27/24 |
A field guide to dumping and reverse engineering a bare-metal U-Boot binary, including all the good stuff like funky hardware setups, UART logs, a locked bootloader and unknown base addresses.
|
| 12/27/24 |
Everyone kind of forgot about DNS. How does it work, how to claim it back and why?
|
| 12/27/24 |
How to remote-control (and build) the weirdest devices with Bluetooth Low Energy and no programming.
|
| 12/28/24 |
In this talk, an advocate of (un)making, Yoshinari Nishiki, dives into the historical foundation of the concept. Starting from the Maker movement, transitioning to Critical Making, evolving into unmaking, and culminating in (un)making, Yoshinari emphasizes a process defined by the deliberate absence of production, where (un)making itself embodies the act of not producing. Unmaking is a newly emerged term in the fields of HCI and design that references the idea of unlearning. In unmaking, ...
|
| 12/28/24 |
In Zeiten, in denen digitale Bildung immer wichtiger wird, bleiben viele Schulen hinter den aktuellen Anforderungen zurück. Ein Ansatz, um das zu ändern, ist der MakerSpace – ein offener Raum, in dem Schüler:innen kreativ arbeiten und selbstständig Projekte umsetzen können. An unserer Schule nutzen wir 3D-Drucker, Lasercutter und andere Technologien, die sowohl für private Projekte als auch im Unterricht eingesetzt werden. Damit haben wir die Möglichkeit, eigene Ideen zu verwirklichen ...
|
| 12/28/24 |
Look behind the scenes with filmmaker, inventor, and former Mythbuster Davis DeWitt and learn how Hollywood hackers combine prototyping and art to bring movie magic to life! Through real-world examples, this talk will explore the unique challenges of creating builds for the entertainment industry, from designing prototypes to filming the final sequence and everything in between.
|
