Reputation
289
Top tag
Next privilege 300 Rep.
Create new tags
Badges
1 11
Newest
 Curious
Impact
~7k people reached

Dec
9
comment What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?
I just tested this procedure on Surface Pro 2. What this actually does is "enable, activate, clear, enable, and active the TPM." I suppose the purpose is to clear everything but bitlocker keys. The device behaves exactly the same after clearing as before: Boots to bitlocker PIN prompt, enter prompt, Windows boots, bitlocker is shown as enabled. Clearing the TPM definitely does not clear the system volume bitlocker key from the TPM.
Dec
3
comment What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?
Hmm...I thought I tested that procedure with the result that Windows can still reboot after clearing the TPM. Now I'm not so sure. I'll have to test this again to be sure.
Dec
3
comment What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?
Both of those links refer to procedures that AFAICT write the keys to the disk in plaintext.
Dec
3
comment What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?
@NeilSmithline I don't see how making a backup would reduce the likelihood of sensitive data being recovered by an attacker. What did you have in mind for "removing the data"? It's not generally possible to securely wipe files from modern computers.
Jun
16
comment IPhone iOS 8.3 encryption security against physical access
related question
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
Thanks Eric. It looks like the reason for the discrepancy is that Windows automatically updates the root certificate store as needed.
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
I just confirmed this. Going to hongkongpost.gov.hk/index.html results in Hongkong Post Root CA1 added to the "Trusted Root Certification Authorities".
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
Can you tell me exactly where you found the Hong Kong Post office root certificate? I've checked on both my windows 7 and 8.1 machines and haven't found it.
Feb
12
comment Does a valid code signing certificate mean that an installer has not been tampered with in transit?
I'm using a script to automate download and validation, so I suppose I could fairly easily assert that the publisher and chain of trust remain the same. I wonder how consistent the certificates used to sign code actually are from update to update.
Feb
11
comment Does a valid code signing certificate mean that an installer has not been tampered with in transit?
This answer seems to speak to TLS communications. The question is about signed files. Can you explain how this applies to the question?
Nov
27
comment Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?
This question is related to your final question.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
Interesting. It looks like a high-entropy key is derived algorithmically from, in part, the passcode. However, this is done in a separate chip containing and using a unique ID. This arrangement complicates performing an offline brute-force attack and limits the online attempt rate. See my answer for more details.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
The second bullet surmises that the key can be algorithmically derived from the passcode. It seems plausible that instead, while the device is locked, a high-entropy key is stored only in a "trusted" area of hardware (a la bitlocker PIN+TPM), and that key is unlocked with the passcode. The premise in that case is that the key is much more difficult to exfiltrate from the "trusted" area of hardware than brute-forcing the 4-digit password after dumping the plain-old flash.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Also, do you have a source supporting the general availability of RdRand to Hyper-V guests? Ostensibly, not all VMWare guests have access to RdRand. It seems like the same might be true for Hyper-V.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Do you have a source for your point (4)? The link you provided does not support it.
Mar
17
comment When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
Thanks for the great answer. I'm not grokking your last paragraph, though. What do you mean by "internal encryption"?
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
'performing the attack' would work just as well for my purposes. I've been hunting for an image of the "specially prepared USB drive" apparently used in the article, without success. I'd like to attempt the attack in the article, but without an image that is pretty tough.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
As we established in the question's comments, this doesn't answer my actual question. The paper is on point, and is a decent survey of plausible attack strategies. However, it only confirms what I already understood: Boot path tampering is detectable by the user when using Bitlocker with "PIN + TPM". My original question of how to simulate such boot path tampering for testing, however, remains.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
@BobWatson I think you've found the root of our miscommunication. Thanks for that. Indeed, I am specifically interested in "'Evil Maid Attack' boot path tampering" (à la the question's title) not every possible flavor of 'Evil Maid Attack' of which there are many, as you have commented.
Feb
13
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
"You're asking to protect yourself in the case where you're leaving your machine unattended." I didn't ask that. With respect, I'm not really interested in opinions about the likelihood of surreptitious replacement of my motherboard. I'm actually interested in an answer to my original question.