Bitlocker Security Questions

hsehestedt · Friday at 3:55 PM

kelper said:
I did say that MY COMPUTER won't boot from USB when secure boot is enabled. You do not need to gainsay what it true

LOL. I bet I know why: Did you patch your system for BlackLotus? If so, you need to update your boot media and then it will boot.

kelper · Friday at 3:56 PM

How do I patch for black lotus? Or are you pulling my leg?

andrew129260 · Friday at 3:57 PM

hsehestedt said:
LOL. I bet I know why: Did you patch your system for BlackLotus? If so, you need to update your boot media and then it will boot.

It's either that or they have the boot menu turned off, which apparently is a setting in their bios.

hsehestedt · Friday at 3:59 PM

kelper said:
How do I patch for black lotus?

Okay, in that case, I guessed incorrectly. Believe me, if you did it, you would know. It's not something you would forget because it's a whole big procedure.

hsehestedt · Friday at 4:31 PM

kelper said:
How do I patch for black lotus? Or are you pulling my leg?

Here is the full detail:

Performing Mitigations for BlackLotus UEFI Bootkit

Please note that this is my first attempt at an article with all the BBcode formatting. Any constructive critisism is welcome. At the same time, I would appreciate it if you could bear in mind that this is a first attempt! This is the initial release of this document, released on May 3, 2024...

www.elevenforum.com

BruceR · Friday at 5:09 PM

kelper said:
If you are going to enter the Bitlocker key at every boot or when you wake the computer from sleep will you enter it from memory? I don't think so.

You don't need to need to enter a 48-digit recovery key at startup. The length of a Bitlocker pre-boot authentication PIN is 6 to 20 characters.

I use the default 6 characters, which is very secure (due to TPM 2.0 anti-hammering) and would take 19 years to crack via brute force.

hdmi · Friday at 6:46 PM

andrew129260 said:
I never said someone would go through that effort on a home user. The point is they can.

The bigger point IMO is they don't need a screwdriver to watch the video that teaches them how.

hdmi · Friday at 7:21 PM

BruceR said:
You don't need to need to enter a 48-digit recovery key at startup. The length of a Bitlocker pre-boot authentication PIN is 6 to 20 characters.

I use the default 6 characters, which is very secure (due to TPM 2.0 anti-hammering) and would take 19 years to crack via brute force.

Of course, you're right. However, an attacker with physical access to the hardware could steal the PIN after having stolen the motherboard + CPU + SSD while having replaced these specific stolen hardware components with ones that are similar, but different, such a way that the unsuspecting user enters the valid PIN into a fake PIN screen, and, immediately thereafter, this valid PIN is transmitted to the attacker. I already pointed this out in my post #63. (It also is part why I wrote what I wrote in my post #74.)

As for an attacker not having the skill and/or determination it takes to break the average home user's protection. All the hard evidence is in support of the claim that it usually takes almost no skill or effort whatsoever. Case in point: besides the determination to click on an article that someone linked to, about the only determination it takes is to click on a link inside that article.

TraderGary · Friday at 8:04 PM

@hdmi, I notice that you are listing two laptop computers. Out of curiosity, what security do you use while mobile?

andrew129260 · Saturday at 12:22 AM

hdmi said:
As for an attacker not having the skill and/or determination it takes to break the average home user's protection. All the hard evidence is in support of the claim that it usually takes almost no skill or effort whatsoever. Case in point: besides the determination to click on an article that someone linked to, about the only determination it takes is to click on a link inside that article.

I think that's being a little disingenuous. A fair amount of work is still involved and you need to actually have tech smarts to do it. It's not like following a simple guide like step 1 etc.

I get what your saying, but I think your being overly critical here.

kelper · Saturday at 2:38 AM

hsehestedt said:
Here is the full detail:

https://www.elevenforum.com/t/performing-mitigations-for-blacklotus-uefi-bootkit.24892/

According to this article Guidance related to Secure Boot Manager changes associated with CVE-2023-24932 | MSRC Blog | Microsoft Security Response Center

"We will be enforcing the protections in three phases to reduce customer and industry partner impact with existing Secure Boot while applying this change.

May 9, 2023: The initial fix for CVE-2023-24932 is released. In this release, this fix requires the May 9, 2023, Windows Security Update and additional customer action to fully implement the protections.
July 11, 2023: A second release will provide additional update options to simplify the deployment of the protections.
First quarter 2024: This final release will enable the fix for CVE-2023-24932 by default and enforce bootmanager revocations on all Windows devices."

hsehestedt · Saturday at 2:48 AM

kelper said:
According to this article Guidance related to Secure Boot Manager changes associated with CVE-2023-24932 | MSRC Blog | Microsoft Security Response Center

"We will be enforcing the protections in three phases to reduce customer and industry partner impact with existing Secure Boot while applying this change.

May 9, 2023: The initial fix for CVE-2023-24932 is released. In this release, this fix requires the May 9, 2023, Windows Security Update and additional customer action to fully implement the protections.

July 11, 2023: A second release will provide additional update options to simplify the deployment of the protections.

First quarter 2024: This final release will enable the fix for CVE-2023-24932 by default and enforce bootmanager revocations on all Windows devices."

Good catch, kelper. I need to look into this and update the article. To be honest, I don't recall that final phase ever happening. I'll need to research this and update the article. I just have not thought about this in a long time.

Thanks for bringing that up.

I spent so much time on that you would think that I would have followed up on it, but time just got away from me

kelper · Saturday at 2:51 AM

@hsehestedt

I'm not too worried about BlackLotus. I need to verify that my laptop won't boot from USB. Maybe it was just that Rufus can't make a bootable USB if secure boot is enabled. I will try a boot now and update this post in a few minutes.

If secure boot is enabled and the BIOS supervisor password is disabled, I can't even get to the BIOS settings by pressing F2 when booting. So I can't change the boot order to use the USB.

I don't really want to enter the BIOS password each time so will probably disable secure boot.

After a few reboots my laptop will go to BIOS settings when I press F2 and will boot from USB. But Without setting a BIOS password, Secure Boot is not secure, is it?

hsehestedt · Saturday at 3:05 AM

kelper said:
@hsehestedt

I'm not too worried about BlackLotus. I need to verify that my laptop won't boot from USB. Maybe it was just that Rufus can't make a bootable USB if secure boot is enabled. I will try a boot now and update this post in a few minutes.

I imagine that you have checked these, but I just thought them worth mentioning in case you missed any:

I have one Mini PC where the only way to boot from USB is to go into the BIOS to the Boot tab and to select an "override" to tell it to do a one time boot from USB.

On other system I have to press a hotkey during post just like for entering the BIOS setup, but this will bring up a boot menu showing bootable devices. I then select the USB device. These are the hotkeys that I am aware of off the top of my head:

Lenovo - ENTER at the post splash screen
HP - ESC
ASUS - F8
Generic AMI BIOS - F7

I also had one laptop in the past where only one of the USB ports was bootable.

Of course, there is also the ever popular method (on some BIOS) of changing the boot order to make USB devices the priority. I'm always leery of using this setting by default because I do a lot of testing with unattended setup and I worry about accidentally booting from a USB device and having it wipe my Windows drive without any warning. In fact, I had a close call about two months ago where I made that very mistake. I accidentally booted from a USB drive and it wiped out a drive. Thankfully I got really lucky. The USB drive was set to erase disk 0 but on that system Windows is not disk 0. Disk 0 turned out to be a blank drive so I lost nothing. But I make sure that the USB drive is never a default boot device for me now.

kelper · Saturday at 3:29 AM

@hsehestedt

I've just edited post #153

hsehestedt · Saturday at 3:56 AM

kelper said:
But Without setting a BIOS password, Secure Boot is not secure, is it?

So, as best as I understand it, Secure Boot will make sure that none of the early boot files have been altered and refuse to boot if something has been altered. But, my assumption is that this works best if you also have BitLocker enabled.

There have been multiple time where I forgot to first suspend BitLocker before making a change in the BIOS. Then, when I try to reboot, the PC flips me off and tells me I need to enter the BL recovery key.

I'm not 100% sure how it behaves when BL is not used on the system

Yet another thing that I should research I guess

hsehestedt · Saturday at 3:58 AM

Okay, that was easy:

What is Secure Boot? - GeeksforGeeks

A Computer Science portal for geeks. It contains well written, well thought and well explained computer science and programming articles, quizzes and practice/competitive programming/company interview Questions.

www.geeksforgeeks.org

hsehestedt · Saturday at 4:00 AM

How did our ancestors live without a search engine? They had to actually travel to a library or seek out experts and talk to them (gasp!).

kelper · Saturday at 5:05 AM

hsehestedt said:
How did our ancestors live without a search engine? They had to actually travel to a library or seek out experts and talk to them (gasp!).

Did you use Google? I find ChatGPT the best way of seaching as it goes straight to the relevany info. It's also pretty good at writing PS scripts.

hsehestedt · Saturday at 5:20 AM

kelper said:
Did you use Google? I find ChatGPT the best way of seaching as it goes straight to the relevany info. It's also pretty good at writing PS scripts.

I'm still in the "do not trust and verify" stage with this AI stuff. I frequently find that I get back info that is just flat out incorrect due to "hallucinations".

Bitlocker Security Questions

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Jack of all trades – master of none

My Computers

Jack of all trades – master of none

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads