Black Hat Europe资料eu-15-Haken-Bypassing-Local-Windows-Authentication-To-Defeat-Full-Disk-Encryption.pdfVIP

Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? • Currently a security researcher at Synopsys, working on application security tools and Coverity’s static analysis product. • Previously received my Ph.D. in mathematics from UC Berkeley. • Twitter: @ianhaken • Email: ian.haken@ Ian Haken Bypassing Local Windows Authentication to Defeat Full Disk Encryption 2 Full Disk Encryption • A scheme for protecting data at rest. Encrypts an entire disk or volume. • Mitigates the impact of a threat with physical access; generally does not provide protection against remote adversaries. • Encrypts everything, often including the OS. Ian Haken Bypassing Local Windows Authentication to Defeat Full Disk Encryption 3 Microsoft BitLocker • BitLocker is Microsofts proprietary full-disk encryption feature. • Built into all professional/enterprise versions of Windows since Vista. • Uses the systems Trusted Platform Module (TPM) to store the master encryption key. Ian Haken Bypassing Local Windows Authentication to Defeat Full Disk Encryption 4 What is a TPM? • A TPM is a hardware module responsible for performing cryptographic operations, performing attestation, and storing secrets. • It has fairly general APIs, so how it is used is mostly up to applications. • Example applications include remote attestation, and storing encryption keys. Ian Haken Bypassing Local Windows Authentication to Defeat Full Disk Encryption 5 Storing Secrets on a TPM • A TPM contains several Platform Configuration Registers (PCRs). • Starting with the BIOS (which is assumed to be trusted), the next part of the boot process (e.g. the MBR) is hashed and this value is stored in the a PCR. • Each stage of the