full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] [IVIZ-08-001] Microsof

Re: [Full-disclosure] [IVIZ-08-001] Microsoft Bitlocker Plain Text Password Disclosure

From: James Matthews <nytrokiss_at_nospam>
Date: Wed Aug 27 2008 - 06:22:26 GMT
To: "Juha-Matti Laurio" <juha-matti.laurio@netti.fi>


Thanks

On Tue, Aug 26, 2008 at 2:37 PM, Juha-Matti Laurio < juha-matti.laurio@netti.fi> wrote:

> Any advisories, CVE available?
>
> The following non-English advisory has been released:
> https://www.cert.dk/nyheder/nyheder.shtml?08-08-26-11-14-00
>
> Juha-Matti
>
> iViZ Security Advisories [advisories@iviztechnosolutions.com] wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > - -----------------------------------------------------------------------
> > [ iViZ Security Advisory 08-001 25/08/2008 ]
> > - -----------------------------------------------------------------------
> > iViZ Techno Solutions Pvt. Ltd.
> > http://www.ivizsecurity.com
> > - -----------------------------------------------------------------------
> >
> > * Title: Microsoft Bitlocker Plain Text Password Disclosure
> > * Date: 25/08/2008
> > * Software: Microsoft Bitlocker
> >
> > - --[ Synopsis:
> >
> > Bitlocker is the disk encryption feature introduced in Microsoft
> > Vista. It has the capability to authentify users in several way,
> > including with a password (PIN), when configured to work with the
> > TPM chip.
> >
> > The password checking routine of Microsoft Bitlocker fails to
> > sanitize the BIOS keyboard buffer after reading passwords, resulting
> > in plain text password leakage to unprivileged local users.
> >
> > - --[ Affected Software:
> >
> > * Microsoft Bitlocker/Vista (SP0)
> >
> > - --[ Non Affected Software:
> >
> > * Microsoft Bitlocker/Vista (SP1)
> >
> > - --[ Technical description:
> >
> > Bitlocker's pre-boot authentication routines use the BIOS API to
> > read user input via the keyboard. The BIOS internally copies the
> > keystrokes in a RAM structure called the BIOS Keyboard buffer
> > inside the BIOS Data Area. This buffer is not flushed after use,
> > resulting in potential plain text password leakage once the OS
> > is fully booted, assuming the attacker can read the password at
> > physical memory location 0x40:0x1e.
> >
> >
> > - --[ Impact:
> >
> > Plain text password disclosure. Local guest access is required,
> > but no physical access to the machine.
> >
> > - --[ Full Technical Whitepaper
> >
> > http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
> >
> > - --[ Vendor response:
> >
> > * Microsoft Bitlocker Team has aknowledged the vulnerability.
> > This vulnerability is fixed in Microsoft Windows Vista (SP1)
> >
> > - --[ Credits:
> >
> > This vulnerability was discovered by Security Researcher
> > Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
> >
> > - --[ Disclosure timeline:
> >
> > * First private disclosure to vendor on May 27th 2008
> > * First vendor reply on May 30th 2008
> > * First Public disclosure at Defcon 16 on August 10th 2008
> >
> > - --[ Reference:
> >
> > http://www.ivizsecurity.com/security-advisory.html
> >
> >
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.7 (MingW32)
> >
> > iD8DBQFIsnLckcchhz1mT/IRAt3yAKCRa6HsWk2T7B3M1o8zzgNgN+h37wCaA0rT
> > WOsiqhwTaGktSAz1mJ8wdgY=
> > =pEvb
> > -----END PGP SIGNATURE-----
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-- http://www.goldwatches.com/

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/