Microsoft BitLocker encryption key got hacked via cheap FGPA

2 min. read

Published onMarch 25, 2019

published onMarch 25, 2019

Share this article

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Securityresearchers identified a new vulnerability inBitlocker as they attempted to use the tool in its basic and least intrusive configuration.

BitLockeris basically a full volume encryption system that allows users toencrypt even entire volumesfor the protection of data. The tool leverages AES encryption algorithm in XTS mode (128-bit or 256-bit key) or AES encryption algorithm in cipher block chaining (CBC).

It has been an integral part of each and every version of Windows starting fromVista. As a quick reminder, users ofWindows 10systems with a TPM 1.2 or 2.0 chip are required to upgrade and run on a Pro, Enterprise or Education versions.

Researcher unlockeda Surface Pro 3 and HP laptop

Researchers have been targeting this highly popularWindows encryption platform to demonstrate its flaws.

One of the latest attempts includes a novel techniquepublished last weekby an employee of PulseSecurityDenis Andzakovic.

The idea has been explained as:

You can sniff BitLocker keys in the default config, from either a TPM1.2 or TPM2.0 device, using a dirt cheap FPGA (~$40NZD) and now publicly available code, or with a sufficiently fancy logic analyzer. After sniffing, you can decrypt the drive.The idea behind this is that if the laptop is stolen, and the attacker does not know yourloginpassword, they cannot pull the drive and read the contents.

However, the Redmond giant already mentioned that users should use any type ofadditional security measures including PIN while using this technology.

How to stay protected?

The researchers suggest staying protected by following two protection measures. The easiest one is to avoid usingBitLocker with TPMs in this default state.

Secondly, you can also follow these simple steps:

Notably, you can use both at the same time by addingmultifactor authentication.

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low#

Copilot in Outlook will generate personalized themes for you to customize the app#

Microsoft will raise the price of its 365 Suite to include AI capabilities#

Death Stranding Director’s Cut is now Xbox X|S at a huge discount#

Outlook will let users create custom account icons so they can tell their accounts apart easier#

Microsoft BitLocker encryption key got hacked via cheap FGPA#

Researcher unlockeda Surface Pro 3 and HP laptop#

How to stay protected?#

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low

Copilot in Outlook will generate personalized themes for you to customize the app

Microsoft will raise the price of its 365 Suite to include AI capabilities

Death Stranding Director’s Cut is now Xbox X|S at a huge discount

Outlook will let users create custom account icons so they can tell their accounts apart easier

Microsoft BitLocker encryption key got hacked via cheap FGPA

Researcher unlockeda Surface Pro 3 and HP laptop

How to stay protected?