BitUnlocker: Leverage Windows Recovery to Extract BitLocker Keys
Demonstrates physical and firmware attack vectors against Windows Recovery environments to extract BitLocker encryption keys from TPM and memory.
Summary
BitLocker Full-Disk Encryption Foundations
Microsoft BitLocker secures enterprise endpoints by sealing full-disk encryption keys within the hardware Trusted Platform Module (TPM) and validating boot integrity.
Attacking the Windows Recovery Environment (WinRE)
David Ledbetter details how physical access to Windows endpoints during WinRE boot sequences exposes diagnostic interfaces and unencrypted memory regions containing keying material.
Sniffing TPM Buses and Memory Extraction
Attaching hardware logic analyzers to LPC or SPI buses during boot allows researchers to intercept plaintext BitLocker Volume Master Keys (VMK) transmitted between the discrete TPM and CPU.
Defensive Hardening for Enterprise Laptops
Mitigating physical BitLocker key extraction requires enabling TPM with startup PINs, deploying integrated/firmware TPMs (fTPM), and restricting WinRE execution.
Related talks
Main Stage·39 min
Matt Burch
Analysis and proof-of-concept exploitation of six zero-day vulnerabilities in Diebold Nixdorf Vynamic Security Suite ATM disk encryption.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.