Germans devise attacks on Windows BitLocker

German researchers have devised five methods that determined attackers can use to bypass hard-drive encryption in recent versions of Microsoft operating systems. The methods, laid out by a research team from the Frauenhofer Institute for Security Information Technology, can be used to access files protected by BitLocker drive …

[Anonymous Coward]

Uncontrolled physical access.

It's already a well-known truism that if the bad guy has physical access to your machine, it's not your machine any more.

It's therefore not all that surprising that if a bad guy has access to your machine, and then you have access to it, and then he has access to it again, you're twice fucked. Because basically the second time /you/ had it, it wasn't your machine that you were entering your password into any more, it was the bad guy's.

[Anonymous Coward]

Did they discuss the lead pipe decryption method?

You know, abduct a user, tie them to a chair and beat them with a lead pipe until they give you the password.

"hardware-level phishing attack," errr wouldn't a key logger be easier? Or the old school video camera pointing at the screen and keyboard so we can see what they type.

Grenade, because if all else fails you can blow it up.

[Tom 35]

I know what his password is...

I watched as he typed it, it was *******

[The Original Ash]

Oh my god!

My password is ******* too! How did he know?!

[Gannon (J.) Dick]

Thanks UK

Sounds like they're still sore about Enigma.

[John Smith 19]

I'm shocked

Microsoft's built in disk encryption is not very good, despite repeated observations that security needs to be *designed* in at the OS level to be effective.

Mine will be the one with OS design by Tannanbaum in it.

[Anonymous Coward]

Err...

Could you elaborate on why it's not very good?

[Graham Marsden]

"hardware-level phishing attack..."

"...in which a target machine is replaced with a counterfeit one that provides precisely the same messages and prompts that the original machine would have produced."

So why not just swap the keyboard for an identical one with a keylogger built in like they did on The Real Hustle?

[NogginTheNog]

Bugger!

Was thinking of enabling Bitlocker on my laptop this weekend too, y'know in the event it gets nicked or lost...

[OziWan]

Do not worry

The attacks described are not suitable for opportunist attacks so, for simply guarding against theft Biltlocker in combination with TPM is quite fine.

[Anonymous Coward]

Bitlocker is fine for that...

...just reinstall BIOS, reformat HDD, reinstall OS if you get it back.

[Anonymous Coward]

Truecrypt

Does the same thing, but competently, and you don't even need "pricier versions" of Windows.

[Anonymous Coward]

but isnt certified

yes...it does the 'same thing' and is somewhaht better because of its other options and flexibility but its not certified. as soon as it is, i'll be moving to it wholesale ;-)

[Anonymous Coward]

Agreed

I like to change the password prompt screen too - it just reads 'Missing operating system' - nothing else, no prompt - nada. It is one of the first things I install on any system (Windows, Linux, doesn't matter), and all of my external drives are truecrypted too - fab

[Ben Tasker]

Hardware Phishing

Nice concept, very imaginative but not really news?

I've got a degree in stating the bleeding obvious, here's my lecture;

If someone can get physical access to your machine, you've had it!

If someone is able to physically swap your machine for an almost identical one that sends your passwords to them, guess what you've had it!

Paris, because every Dev would love to get local physical access!

[b166er]

Erm...

"a target machine is replaced with a counterfeit one that provides precisely the same messages and prompts that the original machine would have produced."

And how exactly would an attacker know which messages and prompts to provide?

If an attacker did in fact know this, presumably by having visual on the target, it would just be easier to snag the password, surely?

[amanfromMars 1]

The Case as Is Presently .... Sourcing Out in the Open

"They rather exploit sequences of actions that Trusted Computing fails to prevent, demonstrating limitations of the technology." ..... Attacking the BitLocker Boot Process [pdf] ... Sven T¨urpe, Andreas Poller, Jan Steffan, Jan-Peter Stotz, and Jan Trukenm¨uller

Hmmm ..... added extra facility with a remote third party controlled application and you say it demonstrates limitations of the technology.

What sort of Pidgin Logic is that?

And you might like to ponder and wonder whether there is a new Class of Virtual Technology of which you have not been appraised/officially informed ...and that would a Failure of Master Government and BBNewspeak.

[Stu J]

"Hardware-based phishing attack"

How is this news, and just how is this isolated to Bitlocker?

It'd be just as easy to knock up a fake PGP or TrueCrypt password prompt for a fully encrypted hard disk.

More needless Microsoft-bashing? If you're prepared to dedicate a considerable amount of time and resources, theoretically nothing's uncrackable this side of quantum encryption......

[Anonymous Coward]

Pointless....

..whoopee do...

throw enough resources at a problem and it you will solve it. Fot those yet again bleating on MS is shite and Open source is indestuctable, you are poor deluded fools, but feel fre to live in your little fantasy worlds....it's safer there.

[pitagora]

keylogger wouldn't work

@oliver 8: you can't install a keylogger if you can't boot the machine. You can't even flash BIOS to include a keylogger because the TPM chip would get you. The combination of TPM+Bitlocker is supposed to make the PC tamper proof.

[Maverick]

market research shock . . .

in which a firm announces new study - everything else is shit, only our product can save the world . . . <sigh>

[TeeCee]

Re: keylogger wouldn't work

Oh yes it would! You may not be able to install a software keylogger that runs on the machine in question, but a hardware one within or in series with the keyboard itself, TPM and drive encryption are no defence against.

As far as I can see here, nobody's cracked BitLocker (or TrueCrypt, or <insert favourite encryption tool>) here, all they've done is outline a few ways of obtaining the password, including a couple of novel ones. But then: "Drive encryption offers no protection when the password is available says German Department of the Bleeding Obvious" doesn't make a good headline.

[Trygve Henriksen]

Sure it would...

You can get HW keyloggers, either as a small adapter that fits between the keyboard and the PS/2 connector, or even built into the keyboard itself.

(Haven't seen any cable adapters for USB keyboards, but it would surprise me if they don't exist)

Portables?

Most people have a dock with external mouse and keyboard (and a big LCD) at the office.

[The Mole 1]

keyloggers

Who ever said that the key logger is software based? It's not hard to build a hardware device that sits between the keyboard and computer intercepting all keystrokes without any software or detection by the TPM chip. Or even as someone else has said is replace the keyboard with one built into it so that the only way to detect it would be a tiny increase in weight in the keyboard. I imagine if you wanted to go even further you could probably put a spy cam in the keyboard and have it pointed at the screen so you could even record what was displayed.

[Will.]

@keylogged wouldn't work

The keyboard-embedded keylogger doesn't need an OS to run. It just listens to keystrokes from the keyboard as they are sent.

[Paul Smith]

@pitagora

"you can't install a keylogger if you can't boot the machine" - Really? Do you want to bet your companies secrets on that?

[Paris Hilton]

@Pitagora

I'm betting you don't work in IT!

No actually I'm Hoping you don't work in IT!

What you doing here?

come to think of it what am I doing here?

[Charles 9]

For those mentioning hardware keyloggers...

...what about laptops? Those keyboards are built-in and can't be swapped, the connector is rather fragile to manhandling, and space is likely to be tight.

[JC 2]

@ For those mentioning hardware keyloggers

Just as everything else has been miniaturized, it should pose little difficulty making a small keylogger. The connector from a keyboard is typically a standard ribbon cable, it would be a fairly trivial thing to slip it inline with the keyboard, placed wherever there is available space and usually there is such space because of the internal componentization of laptops, features not all of them have and the small bits of free space made available by some components (heatsinks for example) needing be larger than the rest while the other casing is flat leaving internal space for air passages.

The connector need not be robust, it is not going to be plugged and unplugged continually it only needs survive the one swap which it certainly can.