{
  "guid": "7de6f4a3-1ef5-51df-bcb4-0203669eeb52",
  "id": 816,
  "date": "2024-12-28T19:15:00+01:00",
  "start": "19:15",
  "duration": "01:00",
  "room": "Stage HUFF",
  "slug": "38c3-windows-bitlocker-screwed-without-a-screwdriver",
  "url": "https://events.ccc.de/congress/2024/hub/de/event/windows-bitlocker-screwed-without-a-screwdriver/",
  "title": "Windows BitLocker: Screwed without a Screwdriver",
  "subtitle": null,
  "language": "en",
  "track": null,
  "type": "Talk 60 (45min +15 Q&A)",
  "abstract": "Ever wondered how Cellebrite and law enforcement gain access to encrypted devices without knowing the password? In this talk, we\u2019ll demonstrate how to bypass BitLocker encryption on a fully up-to-date Windows 11 system using Secure Boot. We\u2019ll leverage a little-known software vulnerability that Microsoft has been unable to patch since 2022: bitpixie (CVE-2023-21563).\r\n\r\nWe'll live-demo the exploit, and will walk through the entire process\u2014from the prerequisites and inner workings of the exploit to why Microsoft has struggled to address this flaw. We'll also discuss how to protect yourself from this and similar vulnerabilities.",
  "description": "BitLocker is Microsoft\u2019s implementation of full-volume encryption. It offers several modes of operation, but the most widely used is Secure Boot-based encryption.\r\nMany consumer and corporate clients use it, and it\u2019s starting to be enabled by default under \"Device Encryption\" on newer Windows 11 installations.\r\n\r\nIn this mode, the harddrive is encrypted at rest but is automatically unsealed when a legit windows boots, meaning users don't need a separate decryption password. They just have to sign in with their usual user account.\r\n\r\nUnfortunately, this configuration has been broken for quite a while. Hardware attacks against a dTPM are widely known, but software attacks are possible as well, at least since 2022, when Rairii discovered the bitpixie bug (CVE-2023-21563).\r\nWhile this bug is 'fixed' since Nov. 2022 and publically known since 2023, we can still use it today with a downgrade attack to decrypt BitLocker.\r\n\r\nIn this talk, we'll dive into:\r\n\r\n- How does Secure Boot work, and what role does the TPM play?\r\n- How can Bitlocker leverage the TPM?\r\n- How does the bitpixie exploit work? What are PXE boot and BCD?\r\n- What are the prerequisites for running this exploit?\r\n- How can you protect yourself against it?\r\n- Why is it so challenging for Microsoft to fully fix this?\r\n- How does this affect Linux secure boot?",
  "logo": null,
  "persons": [
    {
      "guid": "9670f8ee-97a3-5244-9725-b7d75521f7c0",
      "name": "th0mas",
      "public_name": "th0mas",
      "avatar": null,
      "biography": null,
      "url": "https://events.ccc.de/congress/2024/hub/de/user/speaker_9670f8ee-97a3-5244-9725-b7d75521f7c0/"
    }
  ],
  "links": [],
  "origin_url": "https://cfp.cccv.de/38c3-community-stages/talk/LU3PKP/",
  "feedback_url": "https://cfp.cccv.de/38c3-community-stages/talk/LU3PKP/feedback/"
}