Bypassing BitLocker: A Deep Dive into Windows 11 Vulnerabilities and Exploits

• 0:00:22 Introduction: Thomas, a security researcher, introduces the topic of bypassing BitLocker encryption on Windows 11 systems.
• 0:01:25 Background: Thomas shares his journey into low-level hardware security, motivated by a challenge from the Real World CTF competition.
• 0:01:43 BitLocker and Unattended Unlock: Discussion on how BitLocker works, including device encryption, full volume encryption key, and the role of the Trusted Platform Module (TPM) in unattended unlock scenarios.
• 0:08:49 Secure Boot and the Happy Case: Explanation of the secure boot process and how the Windows boot manager uses the TPM to unseal the volume master key.
• 0:11:15 Unhappy Case and the Exploit: Identification of a vulnerability where the boot process fails to wipe encryption keys during a recovery scenario.
• 0:12:38 Bit Pixie Exploit: The exploit, named Bit Pixie, leverages the failure to clear memory after obtaining the decryption key, allowing access to the encrypted data.
• 0:13:45 Demo Setup: Demonstration of the exploit using a Windows 11 laptop with device encryption enabled, connected to another laptop via a LAN cable for network booting.
• 0:17:33 Exploit Flow: Detailed breakdown of the exploit steps, including triggering a recovery scenario via pixie booting, downgrading the boot manager, and booting into a modified Linux environment.
• 0:25:56 Linux and Secure Boot Challenges: Challenges faced due to kernel hardening in secure boot mode, preventing direct memory access.
• 0:27:46 Exploiting the Linux Kernel: Using a known Linux kernel exploit to bypass lockdown mode and gain access to raw memory.
• 0:29:04 Mounting the Encrypted Drive: Utilizing the dislocker tool in Linux to mount the decrypted Windows partition.
• 0:29:33 Live Demo: Live demonstration of the exploit, successfully decrypting the Windows partition and accessing the files.
• 0:34:39 Post-Exploit Analysis: Discussion on the exploit's impact, limitations, and potential mitigations.
• 0:36:08 Microsoft's Response and Challenges: Analysis of Microsoft's response to the vulnerability, including the challenges of patching and the trade-offs between security and usability.
• 0:45:07 PCR Registers and Downgrade Attacks: Explanation of how PCR registers work and why using PCR 7 for secure boot makes the system vulnerable to downgrade attacks.
• 0:46:27 Revocation Issues and Future Outlook: Discussion on the limitations of certificate revocation and the potential implications of rolling over secure boot certificates.
• 0:50:07 Recommendations and Conclusion: Recommendations for protecting against the exploit, including setting a BIOS password, disabling network boot, and using a BitLocker PIN.
• 0:51:45 Other Potential Attacks: Mention of other potential software-based attacks against BitLocker.
• 0:52:03 Call to Action: Encouragement to explore the topic further and participate in cybersecurity challenges.
• 0:52:46 Q&A: Answering questions from the audience and online viewers.