Main Archive Page > Month Archives  > full-disclosure-uk archives

[Full-disclosure] [IVIZ-08-001] Microsoft Bitlocker Plain Text Password Disclosure

From: iViZ Security Advisories <advisories_at_nospam>
Date: Mon Aug 25 2008 - 08:52:46 GMT
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

• ----------------------------------------------------------------------- [ iViZ Security Advisory 08-001 25/08/2008 ]
• ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com
• -----------------------------------------------------------------------
  • Title: Microsoft Bitlocker Plain Text Password Disclosure
  • Date: 25/08/2008
  • Software: Microsoft Bitlocker
• --[ Synopsis:

    Bitlocker is the disk encryption feature introduced in Microsoft     Vista. It has the capability to authentify users in several way,     including with a password (PIN), when configured to work with the     TPM chip.

    The password checking routine of Microsoft Bitlocker fails to     sanitize the BIOS keyboard buffer after reading passwords, resulting     in plain text password leakage to unprivileged local users.

• --[ Affected Software:
  • Microsoft Bitlocker/Vista (SP0)
• --[ Non Affected Software:
  • Microsoft Bitlocker/Vista (SP1)
• --[ Technical description:

    Bitlocker's pre-boot authentication routines use the BIOS API to     read user input via the keyboard. The BIOS internally copies the     keystrokes in a RAM structure called the BIOS Keyboard buffer     inside the BIOS Data Area. This buffer is not flushed after use,     resulting in potential plain text password leakage once the OS     is fully booted, assuming the attacker can read the password at     physical memory location 0x40:0x1e.

• --[ Impact:

    Plain text password disclosure. Local guest access is required,     but no physical access to the machine.

• --[ Full Technical Whitepaper

    http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf

• --[ Vendor response:
  • Microsoft Bitlocker Team has aknowledged the vulnerability. This vulnerability is fixed in Microsoft Windows Vista (SP1)
• --[ Credits:

    This vulnerability was discovered by Security Researcher     Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.

• --[ Disclosure timeline:
  • First private disclosure to vendor on May 27th 2008
  • First vendor reply on May 30th 2008
  • First Public disclosure at Defcon 16 on August 10th 2008
• --[ Reference:

    http://www.ivizsecurity.com/security-advisory.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFIsnLckcchhz1mT/IRAt3yAKCRa6HsWk2T7B3M1o8zzgNgN+h37wCaA0rT WOsiqhwTaGktSAz1mJ8wdgY=
=pEvb
-----END PGP SIGNATURE-----

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/