Bitlocker encrypted access bypassed

Topic

New Reply

Ever wondered how some gain access to encrypted Windows storage without knowing the bitlocker password? ahem..

Someone was able to do just that, using a Windows vulnerability CVE-2023-21563 originally from 2022, with a modified Linux system to access an encrypted Bitlocker drive under a current and fully patched Windows 11 without knowing the bitlocker recovery key!!

The key required to mount/ encrypt/ decrypt the Bitlocker drive was extracted from a Windows memory dump file using a Linux device connected via LAN to Windows 11 using Secure Boot allowing full access and readability of the encrypted drive.
/facepalm

That CVE above was also supposedly fixed again in the January 2023 CU:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21563

Read more about this over on:
https://borncity.com/win/2024/12/31/38c3-bitlocker-bypassed-via-vulnerabilities-dec-2024/#more-36760

If debian is good enough for NASA...

8 users thanked author for this post.

Myst, Cybertooth, windbg, TechTango, Alex5723, Elly, Sky, satrow

Reply | Quote

Replies

The tip of the iceberg in the new world of feel good security.

Reply | Quote

Mike wrote:

new world of feel good security

No such thing, never has been.

cheers, Paul

Reply | Quote

Wait until you really start digging into the implementation details of “Post quantum cryptography” algorithms 🙂

Reply | Quote

Microfix wrote:

The key required to mount/ encrypt/ decrypt the Bitlocker drive was extracted from a Windows memory dump file using a Linux device connected via LAN to Windows 11 using Secure Boot allowing full access and readability of the encrypted drive.

Attack fails if a start-up PIN has been set for Bitlocker:

Memory remanence
…
For scenarios requiring protection against these advanced attacks, configure a TPM+PIN protector,

BitLocker countermeasures

Confirmed at 36:00 and 50:20 of the demo presentation video.

1 user thanked author for this post.

Paul T

Reply | Quote