This is me stealing the Bitlocker disk encryption key from this laptop - in just 43 seconds
- simply by poking it with a 4 dollar raspberry pi pico… This allows me to access all bitlocker
protected data on this system, and even lets me backdoor it.. Lets see how it works!
Lets start by exploring what Bitlocker is: Bitlocker is the full-disk encryption built
into Windows, and according to Microsoft’s documentation Bitlocker addresses the threats
of data theft or exposure from lost, stolen, or inappropriately decommissioned devices.
In my interpretation this should mean that if I steal - or otherwise have temporary access
to this device, I should not be able to decrypt its data, right?
And further down on the page, it’s documented that Bitlocker provides maximum protection
when used with a trusted platform module!
Well luckily, this Lenovo Laptop here contains a TPM! And so according to the Microsoft documentation
Bitlocker should provide maximum protection of my data on this system!
In the Windows settings it’s clear that Bitlocker is indeed turned on, when we remove
the SSD and try to read the Windows partition on another computer, it doesn’t work - the
entire Windows partition is encrypted, and we can’t access any data on it!
But wait a minute.. When I plug it back into the Lenovo computer the computer starts up
fine - but how does windows load when the entire harddrive is encrypted? I didn’t
enter a password during boot, so how is the encryption key protected if not by my password?
Well, as mentioned bitlocker uses the TPM: The trusted platform module. A classical TPM
is a dedicated chip on the motherboard of your computer, And when we open-up this Lenovo
laptop and remove the motherboard, we can find the TPM chip on the backside hidden underneath
this tape.
A TPM is a special chip to provide cryptographic functionality such as encryption key-storage,
generation of random numbers, signature creation and verification, attestation and more.
In the case of bitlocker, the TPM basically stores and protects the key that we need to
decrypt the Windows partition.
So how does Windows actually get this key out of the TPM?
Well, simplified, during boot, the different components of the system, for example the
BIOS, hash their firmware and their configuration, and send that hash to the TPM. This process
is called a measurement: We basically measure the current configuration of the hardware.
On the TPM, this hash is used to update so-called PCRs: Platform configuration registers.
Basically the TPM takes the current value of the PCR and the new measurement, hashes
them both together, and stores the result as the new value of the PCR.
This process will be repeated for example for the bootloader and other components, and
as the new PCR value is always a combination of the previous value and the new measurement
we can determine whether anything in the bootchain has been modified.
So basically the PCRs reflect the state of the system.
There are multiple different PCRs, with each containing a measurement of a certain set
of components - some will change when you replace the hardware, some will only change
when you for example replace the bootloader. You can even configure which PCRs Bitlocker
should use.
The idea is that as long as your system can be considered trusted and unmodified, the
TPM will unseal the key.
But there’s one problem here: The communication between the processor and the TPM is unencrypted.
And when the key is unsealed, the TPM will send it in clear-text to the CPU!
So if we manage to sniff this data, we will be able to steal the bitlocker key! So lets
try to do just that!
We first have to understand how the processor communicates with the TPM. The physical protocol
depends on the chosen TPM, but on my laptop the TPM is connected by LPC: The low pin count
bus.
This bus is relatively simple: We have a simple clock signal, and then 4
bidirectional data lines that are aligned to that clock. There’s also a f rame signal
which indicates when a new transaction starts. There are more signals to LPC, but these are
the ones we care about.
And so to sniff out the key we need to somehow get access to those signals..
Now sure, I could just solder wires to the TPM, but I found that on a lot of laptops,
there are easier ways to access the TPM bus. So I started probing around on the mainboard
with my multimeter, and I found that most of the signals of the LPC bus are easily accessible
on the back of the mainboard: Hidden underneath this black tape is an unpopulated connector,
and after measuring around a bit I found that most of the LPC signals are available on this
connector: The 4 data lines, and the frame signal! But.. no clock signal! And after researching
a bit, it looks like lenovo disables the clock that should normally be on this pin on production
devices by not placing a resistor.
I’m really not sure why they did this - maybe as an attempt to make this connector useless
on production devices? I can only speculate on this.
Now I could still solder just the clock wire on the TPM, but I thought: Lets try to sniff
this without the clock signal. And so I hooked up a couple of needle probes to the connector,
and sniffed the boot up process on the logic analyzer. As the system boots, we can nicely
see all the activity on the TPM bus, but we can’t decode the data yet, because we are
missing that clock signal!
But.. lets look at this. We have these 5 signals: T e 4 data lines, lad 0 to three, and the
lframe line which indicates start of a frame.
Now ideally, we would have a clock line that tells us exactly when to read the state of
those lines. The clock will be 25 MHz, and so every 40 nanoseconds we should read the
data-lines. Now.. what if we just do that but with our own clock? We wait til lframe
goes low - indicating a start of a transaction - wait a couple of nanoseconds, and then read
whatever is on the data lines.
Then we wait 40 nanoseconds, again read all the data, and we repeat that for the entire
frame, and we should get all data! And as the transmissions are relatively short, we
don’t even have to worry too much about our clock getting out of sync!
To prototype this, I wrote a simple analyzer - the code for which you can find in the description
- that does exactly that: And it works! We can decode the TPM transmissions! Without
the clock signal! Perfect!
Now this setup is already enough to read out the bitlocker key - in fact we can find it
in the logic analyzer results here - but it requires quite a bit of equipment and so on,
and it’s not really something trivial or fast to do - and so I wanted to make it easier
and faster.
I ordered a couple of these spring-loaded contacts online, and designed a small PCB
with - you guessed it - a raspberry pi pico - and with pads onto which I can solder these
spring-loaded contacts in just the right distance so they fit onto the mainboard connector pads.
After a couple of days the PCBs arrived, and the finished tpm sniffer looks like this:
I soldered on a raspberry pi pico and the pogo pins, and now I have a small tool that
I can just push onto the connector in the laptop and that establishes a decent connection.
The total costs of parts for this are like 10 dollars…
And after hacking together a bit of firmware - which basically just does what I just described
and which you can - as always - find linked in the description - I was ready to give it
a go:
I turn on the computer, push my adapter down… And as the system boots the VMK - the volume
master key - appears on the computer!
And if we take the SSD now, and connect it to a Linux machine, we can use the VMK that
we just collected with an open-source tool called dislocker, to decrypt the drive: As
you can see, I can browse through all files on the encrypted machine, and also modify
or backdoor the system.
We just successfully attacked the bitlocker full disk encryption with $10 of equipment
- and didn’t really need any super advanced skills or tools.
Now this is not a new type of attack. I’ve linked some papers and other blogposts about
similar attacks in the description. In fact, you can even find some vague documentation
on the bottom of the bitlocker countermeasures page:
According to it, an attacker needs skill, lengthy physical access, plenty of time, must
be able to open the case, must be able to solder, and requires sophisticated hardware
and software.
Now watch how long it takes - when you’re prepared - to conduct this attack on this
laptop:
I open the case using a regular screwdriver, and then I turn on the laptop, I push the$10
pogo pin setup against it… And I have the key. All in less than 50 seconds.
I’m not sure that counts as plenty of time.
It also suggests mitigations, and the main recommendation here is setting the preboot
authentication to TPM with a PIN protector. This will protect the TPM with a pin! Unfortunately
it seems like there is no way in the bitlocker settings to enable this. Instead, it seems
to only be possible via group policy.
Now obviously the adapter - which by the way is fully open-source and so you can build
your own - only works with certain Lenovo laptops. But a lot of laptops have similar
access to the TPM pins. For example, Pascal, a friend of mine who also gave me a lot of
information about TPMs and their usage, provided me with this picture of a Microsoft Surface
Pro: Again the LPC bus is easily accessible on the back of the device - in this case he
even just cut a hole into the case instead of removing the backside.
Now some modern CPUs have so-called fTPMS: Firmware TPMs that are integrated into the
CPU. We can’t sniff the bus there, and so this attack won’t work there. However most
business laptops seem to still have dedicated TPMs.
I’ve also linked instructions on how to enable a PIN on your bitlocker-enabled system
to help you make your systems more secure.
Now if you’ve watched this far, I want to tell you about something that I’ve been
working on together with LiveOverflow: Hextree.io, our online security learning platform. On
hextree.io you will be able to learn reverse engineering, hardware hacking, web-security
and more in well produced microcourses. You can sign-up to our waiting list using the
link below!
I hope you enjoyed this video, and to see you on this channel again soon!