Security Advisories
Microsoft Bitlocker Plain Text Password Disclosure
Synopsis
Bitlocker is the disk encryption feature introduced in Microsoft
Vista. It has the capability to authentify users in several way,
including with a password (PIN), when configured to work with the
TPM chip.
The password checking routine of Microsoft Bitlocker fails to
sanitize the BIOS keyboard buffer after reading passwords, resulting
in plain text password leakage to unprivileged local users.
Affected Software
Microsoft Bitlocker/Vista (SP0)
Unaffected Software
TMicrosoft Bitlocker/Vista (SP1)
Technical Description
Bitlocker's pre-boot authentication routines use the BIOS API to
read user input via the keyboard. The BIOS internally copies the
keystrokes in a RAM structure called the BIOS Keyboard buffer
inside the BIOS Data Area. This buffer is not flushed after use,
resulting in potential plain text password leakage once the OS
is fully booted, assuming the attacker can read the password at
physical memory location 0x40:0x1e.
Impact
Plain text password disclosure. Local guest access is required,
but no physical access to the machine.
Full Technical Whitepaper
Patch Description
Vendor Response
Microsoft Bitlocker Team has acknowledged the vulnerability.
This vulnerability is fixed in Microsoft Windows Vista (SP1)
Credits
This vulnerability was discovered by Security Researcher
Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
Disclosure Timeline
First private disclosure to vendor on May 27th 2008
First vendor reply on May 30th 2008
First Public disclosure at Defcon 16 on August 10th 2008
Back to Security Advisories
|
