Microsoft’s Bitlocker & TPM encryption combo defeated with a $10 Raspberry Pi::The point of Microsoft’s Bitlocker security feature is to protect personal data stored locally on devices and particularly when those devices are lost or otherwise physically compromised. With Bi

    • n2burns@lemmy.ca
      link
      fedilink
      English
      arrow-up
      24
      ·
      9 months ago

      Isn’t the whole point of BitLocker protection from direct access? When a computer is turned off, encryption should keep the data safe. Also when a computer is turned off, basically no remote vector is going to work. AFAIK, when the computer is on, the drive is mounted and BitLocker provides no additional protection over an unencrypted drive.

      • kadu@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        9 months ago

        Yes, you’re correct. It’s just that if somebody is got full access to your hardware, with no time limits and can just poke around your pcb, BitLocker is the least of your concerns. It should still not be flawed - but at that point, even Samsung’s Knox, Qualcomm’s memory protection and Apple’s Secure Enclave have failed in the past, allowing the tinkerer to extract decryption keys.

        It’s more realistic to expect BitLocker to protect your external hard drive in case I grab it and run away, rather than expecting your computer to be bullet proof in case I aprehend the entire device.

        But again, I do agree, this is a vulnerability and it’s an issue, though limited to people using an actual TPM module rather than the built in one in the CPU.

        • ryannathans@aussie.zone
          link
          fedilink
          English
          arrow-up
          2
          ·
          9 months ago

          Veracrypt drive encryption does not have the same problem, it would be secure even with physical access

          • kadu@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            9 months ago

            I don’t think a Veracrypt setup could use a hardware pairing for the decryption key, and also boot from an encrypted drive, though.

            • ryannathans@aussie.zone
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              9 months ago

              Yeah, it’s safe because of no TPM usage. You can boot from an encrypted drive, it’ll prompt for the key instead of auto loading from vulnerable hardware

              • Natanael@slrpnk.net
                link
                fedilink
                English
                arrow-up
                3
                ·
                9 months ago

                Bitlocker supports the same usecase, but everybody wants that automatic boot feature so…

                It also lets you store a secondary key on a server and require the computer to be on trusted networks to be able to retrieve it to boot, but I’ve never ever heard of anybody using that

    • Godort@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      ·
      9 months ago

      Correct. However, if you have a way to run a PowerShell command as an administrator, you can run a single cmdlet to get access to the bitlocker recovery key.