- Joined
- Jan 5, 2006
- Messages
- 17,965 (2.68/day)
| System Name | AlderLake / Laptop |
|---|---|
| Processor | Intel i7 12700K P-Cores @ 5Ghz / Intel i3 7100U |
| Motherboard | Gigabyte Z690 Aorus Master / HP 83A3 (U3E1) |
| Cooling | Noctua NH-U12A 2 fans + Thermal Grizzly Kryonaut Extreme + 5 case fans / Fan |
| Memory | 32GB DDR5 Corsair Dominator Platinum RGB 6000MT/s CL36 / 8GB DDR4 HyperX CL13 |
| Video Card(s) | MSI RTX 2070 Super Gaming X Trio / Intel HD620 |
| Storage | Samsung 980 Pro 1TB + 970 Evo 500GB + 850 Pro 512GB + 860 Evo 1TB x2 / Samsung 256GB M.2 SSD |
| Display(s) | 23.8" Dell S2417DG 165Hz G-Sync 1440p / 14" 1080p IPS Glossy |
| Case | Be quiet! Silent Base 600 - Window / HP Pavilion |
| Audio Device(s) | Panasonic SA-PMX94 / Realtek onboard + B&O speaker system / Harman Kardon Go + Play / Logitech G533 |
| Power Supply | Seasonic Focus Plus Gold 750W / Powerbrick |
| Mouse | Logitech MX Anywhere 2 Laser wireless / Logitech M330 wireless |
| Keyboard | RAPOO E9270P Black 5GHz wireless / HP backlit |
| Software | Windows 11 / Windows 10 |
| Benchmark Scores | Cinebench R23 (Single Core) 1936 @ stock Cinebench R23 (Multi Core) 23006 @ stock |
A security researcher has managed to crack a laptop encrypted with BitLocker in under a minute using a modified Raspberry Pi Pico.
The attack does require physical access to the laptop.
Microsoft's BitLocker tool protects data on hard drives by encrypting them. However, Stacksmashing discovered that the key used for this can easily be intercepted via a 'sniffing attack'. Network traffic is tapped to intercept information.
BitLocker concerns the traffic that is exchanged between a separate Trusted Platform Module, or TPM, and the CPU in a laptop. BitLocker uses the TPM chip in a laptop to store the decryption key. To make the drive accessible when the laptop starts, the key is sent to the CPU. However, the communication between the processor and the TPM is not encrypted, meaning that the key is sent in cleartext. By listening in on this communication, Stacksmashing was able to retrieve the key.
Stacksmashing made a so-called TPM sniffer from a Raspberry Pi Pico. He connected the single-board computer to the LPC Bus in the laptop, allowing him to intercept the traffic. After obtaining the key, the researcher used the open source tool Disclocker to decrypt the drive. He could then view all the data.
Microsoft has been aware of these types of attacks for some time, but emphasizes that attackers need 'sufficient time' to do so. However, Stacksmashing only needed 43 seconds to open the laptop, connect the TPM sniffer to the LPC Bus and steal the key. The hardware needed to make the TPM sniffer cost him just ten dollars.
Stacksmashing used a Lenovo laptop for its attack, but other laptops are also vulnerable. However, the attack only works if a laptop has a separate TPM and CPU. If the two are combined, which is the case on many laptops, the attack does not work. Users who want to protect themselves against such an attack can take mitigating measures by configuring a PIN, according to Microsoft.
tweakers.net
The attack does require physical access to the laptop.
Microsoft's BitLocker tool protects data on hard drives by encrypting them. However, Stacksmashing discovered that the key used for this can easily be intercepted via a 'sniffing attack'. Network traffic is tapped to intercept information.
BitLocker concerns the traffic that is exchanged between a separate Trusted Platform Module, or TPM, and the CPU in a laptop. BitLocker uses the TPM chip in a laptop to store the decryption key. To make the drive accessible when the laptop starts, the key is sent to the CPU. However, the communication between the processor and the TPM is not encrypted, meaning that the key is sent in cleartext. By listening in on this communication, Stacksmashing was able to retrieve the key.
Stacksmashing made a so-called TPM sniffer from a Raspberry Pi Pico. He connected the single-board computer to the LPC Bus in the laptop, allowing him to intercept the traffic. After obtaining the key, the researcher used the open source tool Disclocker to decrypt the drive. He could then view all the data.
Microsoft has been aware of these types of attacks for some time, but emphasizes that attackers need 'sufficient time' to do so. However, Stacksmashing only needed 43 seconds to open the laptop, connect the TPM sniffer to the LPC Bus and steal the key. The hardware needed to make the TPM sniffer cost him just ten dollars.
Stacksmashing used a Lenovo laptop for its attack, but other laptops are also vulnerable. However, the attack only works if a laptop has a separate TPM and CPU. If the two are combined, which is the case on many laptops, the attack does not work. Users who want to protect themselves against such an attack can take mitigating measures by configuring a PIN, according to Microsoft.
Youtuber kraakt BitLocker-versleuteling binnen minuut met Raspberry Pi Pico
Een beveiligingsonderzoeker is erin geslaagd een laptop die met BitLocker is versleuteld binnen een minuut te kraken met behulp van een aangepaste Raspberry Pi Pico. Voor de aanval is wel fysieke toegang tot de laptop nodig.
