Microsoft Bitlocker Plain Text Password Disclosure
Bitlocker is the disk encryption feature introduced in Microsoft
Vista. It has the capability to authentify users in several way,
including with a password (PIN), when configured to work with the
The password checking routine of Microsoft Bitlocker fails to
sanitize the BIOS keyboard buffer after reading passwords, resulting
in plain text password leakage to unprivileged local users.
Microsoft Bitlocker/Vista (SP0)
TMicrosoft Bitlocker/Vista (SP1)
Bitlocker's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e.
Plain text password disclosure. Local guest access is required,
but no physical access to the machine.
Full Technical Whitepaper
Microsoft Bitlocker Team has acknowledged the vulnerability.
This vulnerability is fixed in Microsoft Windows Vista (SP1)
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
First private disclosure to vendor on May 27th 2008
First vendor reply on May 30th 2008
First Public disclosure at Defcon 16 on August 10th 2008
Back to Security Advisories