Security Advisories

Microsoft Bitlocker Plain Text Password Disclosure

Synopsis

Bitlocker is the disk encryption feature introduced in Microsoft Vista. It has the capability to authentify users in several way, including with a password (PIN), when configured to work with the TPM chip. The password checking routine of Microsoft Bitlocker fails to sanitize the BIOS keyboard buffer after reading passwords, resulting in plain text password leakage to unprivileged local users.

Affected Software

Microsoft Bitlocker/Vista (SP0)

Unaffected Software

TMicrosoft Bitlocker/Vista (SP1)

Technical Description

Bitlocker's pre-boot authentication routines use the BIOS API to read user input via the keyboard. The BIOS internally copies the keystrokes in a RAM structure called the BIOS Keyboard buffer inside the BIOS Data Area. This buffer is not flushed after use, resulting in potential plain text password leakage once the OS is fully booted, assuming the attacker can read the password at physical memory location 0x40:0x1e.

Impact

Plain text password disclosure. Local guest access is required, but no physical access to the machine.

Full Technical Whitepaper

Technical Whitepaper

Patch Description

Read the detailed fix description

Vendor Response

Microsoft Bitlocker Team has acknowledged the vulnerability. This vulnerability is fixed in Microsoft Windows Vista (SP1)

Credits

This vulnerability was discovered by Security Researcher Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.

Disclosure Timeline

First private disclosure to vendor on May 27th 2008
First vendor reply on May 30th 2008
First Public disclosure at Defcon 16 on August 10th 2008



Back to Security Advisories