{"id":4923,"date":"2019-05-17T22:49:06","date_gmt":"2019-05-17T20:49:06","guid":{"rendered":"https:\/\/www.sec4you.com\/?p=4923"},"modified":"2022-11-06T09:51:33","modified_gmt":"2022-11-06T08:51:33","slug":"pentest-attack-or-data-recovery-from-bitlocker-encrypted-systems","status":"publish","type":"post","link":"https:\/\/www.sec4you.com\/en\/pentest-attack-or-data-recovery-from-bitlocker-encrypted-systems\/","title":{"rendered":"Pen\u00adTest attack or data reco\u00advery from Bit\u00adLo\u00adcker encrypt\u00aded systems"},"content":{"rendered":"

As an exten\u00adsi\u00adon of the SEC4YOU<\/span> Pen\u00adTest port\u00adfo\u00adlio, we offer a stan\u00addar\u00addi\u00adzed audit of Micro\u00adsoft Bit\u00adLo\u00adcker encrypt\u00aded sys\u00adtems (ser\u00advers, work\u00adsta\u00adtions, note\u00adbooks, tablets) with the aim to bypass the Bit\u00adLo\u00adcker encryp\u00adti\u00adon and extra\u00adct all data.<\/p>\n

The method used is the TPM<\/span> snif\u00adfing attack on the TPM<\/span> chip descri\u00adbed in March 2019, here is the Link to the Exploit<\/a>.<\/p>\n

The attack requi\u00adres phy\u00adsi\u00adcal access to the PC<\/span>, with a spe\u00adci\u00adal\u00adly pre\u00adpared FPGA<\/span> (a Field Pro\u00adgramma\u00adble Gate Array) being atta\u00adched to the TPM<\/span> 1.2 or TPM<\/span> 2.0 as part of the intru\u00adsi\u00adon attempt. During Win\u00addows boot with Micro\u00adsoft encryp\u00adti\u00adon enab\u00adled, the Volu\u00adme Mas\u00adter Key (VMK<\/span>) is trans\u00admit\u00adted from the TPM<\/span> to the Win\u00addows sys\u00adtem, whe\u00adre it is inter\u00adcept\u00aded and log\u00adged by the FPGA<\/span>. This key is used to decrypt the Full Volu\u00adme Encryp\u00adti\u00adon Key (FVEK<\/span>) of the sys\u00adtem drive.<\/p>\n

The fol\u00adlo\u00adwing sys\u00adtems are vulnerable:<\/p>\n