So I’ve just had a quick play with this and yes, it works.

[fencepost@infosec.exchange]

@kirenida @GossiTheDog if the drive is still in the dead system you'd be better off trying to get it to a point where it'll boot to the point of the TPM being read.

[j91321@infosec.exchange]

@GossiTheDog It did cross my mind that this could perhaps be the person who used to drop 0-days on Twitter a few years ago when they were having a bad day.

[gunstick@mastodon.opencloud.lu]

@gsuberland @kirenida @GossiTheDog It could maybe restore my windows where bitlocker prompts me for the key which I have forgotten. Or I get that prompt because my TPM forgot the key, and that's then not possible.
Anyway, running linux now.

[dzwiedziu@mastodon.social]

@prsfalken
This probably would be the only option that this is not a back door.

Otherwise I'd say this is the reason the backdoor was found

@barubary @GossiTheDog

[kkarhan@c.im]

@GossiTheDog I never trusted #BitLocker with it's #Govware - #Backdoor anyway!

- Cuz now people put that trust into some #BackBox IC (#TPM) that is usually soldered down on the board that may or may not be #exploitable from the factory (whether due to #bugs, #incompetence or "Export Restrictions #Compliance" is irrelevant for the affected End-Users!)…

- If (for some horrible reason that I refuse to acknowledge as legitimate!) someone needs a #Windows machine BUT with #FullDiskEncryption, they should use the only REAL #FDE: #VeraCrypt!

#CensorBoot never was about #Security…

- Calling it "#SecureBoot" is adopting the enemy's #Propaganda-Speak!

[gsuberland@chaos.social]

@gunstick @kirenida @GossiTheDog nope. it needs a functioning TPM with the right key, and BitLocker in no password mode. this is only functionally a login bypass.

[dzwiedziu@mastodon.social]

@GossiTheDog
Oh wow, a backdoor in a Microsoft product, much wow \s

[jimmyhoke@fosstodon.org]

@GossiTheDog I am shocked. Shocked I say!

[jimmyhoke@fosstodon.org]

@GossiTheDog

Rememeber: never ask “is this Microsoft security product backdoored?”

Instead ask: “how exactly is it backdoored? How many back doors are there?”

[rairii@labyrinth.zone]

@GossiTheDog i wouldn't be surprised if this was supposed to only be built in certain branches via velocity configuration, and someone fucked up when merging some other changes in

[jimmyhoke@fosstodon.org]

@GossiTheDog Also: that’s worse?

- Microsoft and intentionally backdooring BitLocker
- Microsoft unintentionally backdooring bitlocker

[seharinsights@mastodon.social]

@GossiTheDog great

[gossithedog@cyberplace.social]

For anybody looking at this, testing showed two things:

- TPM unlocked the storage
- it provides a login bypass, as you’re dumped as SYSTEM prior to Windows Hello or password login

BitLocker operates without a PIN by default so it’s basically a big gap, it’s unclear how this code made it into the production version of Windows.

[gossithedog@cyberplace.social]

I should point out I’ve only tested with one version of Windows 11 - maybe the scope is smaller.

[gvs@rebelbase.site]

@GossiTheDog I'd be highly surprised if it didn't have a backdoor. Microsoft is not a company you should trust

[kallisti@infosec.exchange]

@GossiTheDog

I was worried I'd run out of tools that do not require opening a computer/laptop case, now that Microsoft's planning to patch Bitpixie this year.

But Windows is a gift that just keeps on giving

[gerowen@mastodon.social]

@GossiTheDog I always assumed anything that could unlock an encrypted drive with no password or other authentication from the user could be bypassed. I figured if you don't have to enter a password, you have to assume that neither does anybody else.

[avery@furry.engineer]

@GossiTheDog hi just out of curiosity why would a bios password help / be required? is that only for if pcr7 isn't bound?

[tanavit@toot.aquilenet.fr]

Poc @sebsauvage

@GossiTheDog

[sebsauvage@framapiaf.org]

@tanavit @GossiTheDog
Haha oui j'ai vu passer ça, ainsi qu'une faille RCE dans Word.