According to TechSpot , although BitLocker is integrated on Windows 11 Pro, Enterprise and Education versions with the purpose of enhancing data security with AES encryption algorithm, a recent study shows that this encryption tool can be easily cracked with just a cheap device.
In a YouTube video, security researcher Stacksmashing demonstrated how hackers can extract BitLocker encryption keys from Windows computers in just 43 seconds, using a Raspberry Pi Pico device. According to the researcher, targeted attacks can bypass BitLocker encryption by directly accessing the hardware and extracting encryption keys stored in the computer's Trusted Platform Module (TPM) via the LPC port.
Microsoft's Famous Data Encryption Tool Can Be Easily Bypassed
The vulnerability is due to a design flaw found in devices with dedicated TPMs, such as newer laptops and desktops. As the researcher explains, BitLocker sometimes uses an external TPM to store important key information, such as Platform Configuration Registers and Volume Master Keys. However, the communication lines (LPC ports) between the CPU and the external TPM are not encrypted at boot time, allowing an attacker to monitor any traffic between the two components and extract the encryption key.
To perform the demonstration attack, Stacksmashing used a 10-year-old BitLocker-encrypted laptop, then programmed a Raspberry Pi Pico to read the raw binary from the TPM to extract the Volume Master Key. He then used Dislocker with the newly obtained Volume Master Key to decrypt the drive.
This isn't the first time BitLocker has been cracked. Last year, cybersecurity researcher Guillaume Quéré demonstrated how the BitLocker full-disk encryption system could allow users to spy on any information passing between a separate TPM chip and the CPU via the SPI port. However, Microsoft claims that breaking BitLocker encryption is a long and complicated process that requires permanent access to the hardware.
The latest attack shows that BitLocker can be bypassed much more easily than previously thought, and it raises important questions about current encryption methods. Whether Microsoft will fix this particular vulnerability in BitLocker remains to be seen, but in the long run, cybersecurity researchers need to do a better job of identifying and patching potential security holes before they become a problem for users.
Source link
Comment (0)