full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] [IVIZ-08-001] Microsof

Re: [Full-disclosure] [IVIZ-08-001] Microsoft Bitlocker Plain Text Password Disclosure

From: Juha-Matti Laurio <juha-matti.laurio_at_nospam>
Date: Tue Aug 26 2008 - 21:37:28 GMT
To: full-disclosure@lists.grok.org.uk, iViZ Security Advisories <advisories@iviztechnosolutions.com>


Any advisories, CVE available?

The following non-English advisory has been released: https://www.cert.dk/nyheder/nyheder.shtml?08-08-26-11-14-00

Juha-Matti

iViZ Security Advisories [advisories@iviztechnosolutions.com] wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - -----------------------------------------------------------------------
> [ iViZ Security Advisory 08-001 25/08/2008 ]
> - -----------------------------------------------------------------------
> iViZ Techno Solutions Pvt. Ltd.
> http://www.ivizsecurity.com
> - -----------------------------------------------------------------------
>
> * Title: Microsoft Bitlocker Plain Text Password Disclosure
> * Date: 25/08/2008
> * Software: Microsoft Bitlocker
>
> - --[ Synopsis:
>
> Bitlocker is the disk encryption feature introduced in Microsoft
> Vista. It has the capability to authentify users in several way,
> including with a password (PIN), when configured to work with the
> TPM chip.
>
> The password checking routine of Microsoft Bitlocker fails to
> sanitize the BIOS keyboard buffer after reading passwords, resulting
> in plain text password leakage to unprivileged local users.
>
> - --[ Affected Software:
>
> * Microsoft Bitlocker/Vista (SP0)
>
> - --[ Non Affected Software:
>
> * Microsoft Bitlocker/Vista (SP1)
>
> - --[ Technical description:
>
> Bitlocker's pre-boot authentication routines use the BIOS API to
> read user input via the keyboard. The BIOS internally copies the
> keystrokes in a RAM structure called the BIOS Keyboard buffer
> inside the BIOS Data Area. This buffer is not flushed after use,
> resulting in potential plain text password leakage once the OS
> is fully booted, assuming the attacker can read the password at
> physical memory location 0x40:0x1e.
>
>
> - --[ Impact:
>
> Plain text password disclosure. Local guest access is required,
> but no physical access to the machine.
>
> - --[ Full Technical Whitepaper
>
> http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
>
> - --[ Vendor response:
>
> * Microsoft Bitlocker Team has aknowledged the vulnerability.
> This vulnerability is fixed in Microsoft Windows Vista (SP1)
>
> - --[ Credits:
>
> This vulnerability was discovered by Security Researcher
> Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
>
> - --[ Disclosure timeline:
>
> * First private disclosure to vendor on May 27th 2008
> * First vendor reply on May 30th 2008
> * First Public disclosure at Defcon 16 on August 10th 2008
>
> - --[ Reference:
>
> http://www.ivizsecurity.com/security-advisory.html
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (MingW32)
>
> iD8DBQFIsnLckcchhz1mT/IRAt3yAKCRa6HsWk2T7B3M1o8zzgNgN+h37wCaA0rT
> WOsiqhwTaGktSAz1mJ8wdgY=
> =pEvb
> -----END PGP SIGNATURE-----
>



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/