As an extension of the SEC4YOU PenTest portfolio, we offer a standardized audit of Microsoft BitLocker encrypted systems (servers, workstations, notebooks, tablets) with the aim to bypass the BitLocker encryption and extract all data.
The method used is the TPM sniffing attack on the TPM chip described in March 2019, here is the Link to the Exploit.
The attack requires physical access to the PC, with a specially prepared FPGA (a Field Programmable Gate Array) being attached to the TPM 1.2 or TPM 2.0 as part of the intrusion attempt. During Windows boot with Microsoft encryption enabled, the Volume Master Key (VMK) is transmitted from the TPM to the Windows system, where it is intercepted and logged by the FPGA. This key is used to decrypt the Full Volume Encryption Key (FVEK) of the system drive.
The following systems are vulnerable:
- All BitLocker versions of the operating systems: Windows 7, Windows 8, Windows 10 incl. version 1903.
- Any TPM-only protected hardware: servers, workstations, notebooks, tablets.
After the attack, the FPGA is removed from the TPM chip and the system can be rebooted. Recovery through the recovery key is not provided for this hack.
Data recovery or simulation of a cyber attack.
The PenTest is useful in two customer requirements:
- Verification of the operational effectiveness of deployed BitLocker encryption.
- Data recovery from BitLocker encrypted end devices
-
- that no longer boot correctly, e.g. blue screen, bad sectors, update problems, driver problems
- whose recovery key and user password has been lost
We will be happy to clarify the procedure and technical requirements in a personal meeting.
As a result of the PenTest, the decrypted data of all users will be made available on an external storage medium.
