So I’ve just had a quick play with this and yes, it works.

[rairii@labyrinth.zone]

@GossiTheDog i wouldn't be surprised if this was supposed to only be built in certain branches via velocity configuration, and someone fucked up when merging some other changes in

[jimmyhoke@fosstodon.org]

@GossiTheDog Also: that’s worse?

- Microsoft and intentionally backdooring BitLocker
- Microsoft unintentionally backdooring bitlocker

[seharinsights@mastodon.social]

@GossiTheDog great

[gossithedog@cyberplace.social]

For anybody looking at this, testing showed two things:

- TPM unlocked the storage
- it provides a login bypass, as you’re dumped as SYSTEM prior to Windows Hello or password login

BitLocker operates without a PIN by default so it’s basically a big gap, it’s unclear how this code made it into the production version of Windows.

[gossithedog@cyberplace.social]

I should point out I’ve only tested with one version of Windows 11 - maybe the scope is smaller.

[gvs@rebelbase.site]

@GossiTheDog I'd be highly surprised if it didn't have a backdoor. Microsoft is not a company you should trust

[kallisti@infosec.exchange]

@GossiTheDog

I was worried I'd run out of tools that do not require opening a computer/laptop case, now that Microsoft's planning to patch Bitpixie this year.

But Windows is a gift that just keeps on giving

[gerowen@mastodon.social]

@GossiTheDog I always assumed anything that could unlock an encrypted drive with no password or other authentication from the user could be bypassed. I figured if you don't have to enter a password, you have to assume that neither does anybody else.

[avery@furry.engineer]

@GossiTheDog hi just out of curiosity why would a bios password help / be required? is that only for if pcr7 isn't bound?

[tanavit@toot.aquilenet.fr]

Poc @sebsauvage

@GossiTheDog

[sebsauvage@framapiaf.org]

@tanavit @GossiTheDog
Haha oui j'ai vu passer ça, ainsi qu'une faille RCE dans Word.

[notavi10@critter.cafe]

@GossiTheDog why is Microsoft so lazy when it comes to developing mission critical software

[berglerma@mastodon.social]

@gsuberland @mkoek @GossiTheDog Unless Microsoft made another mistake this shouldn't be possible. Accessing disk encryption keys should always use what is called a "salted session", where the communication between TPM and application is encrypted, precisely to prevent passive attacks on the bus.

[s1m@infosec.exchange]

@GossiTheDog

@drm Plus besoin de s'embêter à faire du TPM sniffing

[splinux@mastodon.uno]

@GossiTheDog thanks God i can recover an Old ssd whose bitlocker key is somewhere in the short-circuited mainboard Something Something Secure Module and I happen to not have a backup of that specific bitlocker key

[drm@mastodon.social]

@S1m @GossiTheDog testé hier par un collègue, ça marche bien ! Mais ça va être rapidement patché...

[s1m@infosec.exchange]

@drm @GossiTheDog Toujours à la pointe les collègues. C'est pas un patch qui nécessite une mise à jour des certifs secureboot ça ? Le genre de mise à jour qui est toujours retardée

[drm@mastodon.social]

@S1m @GossiTheDog . Je crois que tu confonds avec cette vuln https://github.com/garatc/BitUnlocker

[moelassus@mastodon.social]

@GossiTheDog I suspect you have that NSA key set.

[s1m@infosec.exchange]

@drm @GossiTheDog Ah bah j'ai toujours cru que Bitlocker était by-design vuln aux downgrade attacks