3

Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically protects against bootkits that otherwise could surreptitiously log the password or key used to decrypt the OS drive. That is, it protects against this type of "evil maid attack".

Is there a way to reliably simulate boot path tampering to test whether boot path authentication is actually working?

I know about this implementation of the evil maid attack but it was designed to attack truecrypt, not bitlocker.

Improve this question
7
  • 1
    You may be interested in truecrypt.org/faq#tpm - but the upshot is, if someone is targeting you and has physical access to the machine; you've essentially already lost.
    – Bob Watson
    Commented Feb 13, 2013 at 6:13
  • Thanks @BobWatson. I have seen that argument advanced before. It seems to lump all forms of physical access threats together. In particular, it dismisses the idea of protecting against boot path tampering because a hardware key logger could be installed. Personally, I don't follow that argument: I can disassemble my laptop and fairly confidently rule out the existence of a hardware key logger, so why shouldn't I use a TPM to rule out the existence of a boot-path key logger?
    – alx9r
    Commented Feb 13, 2013 at 6:48
  • 1
    That's just one way of doing it. You're asking to protect yourself in the case where you're leaving your machine unattended for some amount of time with a dedicated attacker; what's to say they don't replace your keyboard with an identical one with 'evil' firmware? Why not install DIMMs that have smarts to look for the info they're after? You can protect against casual attention with the TPM+PIN, or truecrypt, but if someone is willing to do a bootkit attack they're most likely willing to replace your mainboard with a malicious one.
    – Bob Watson
    Commented Feb 13, 2013 at 7:06
  • 1
    That is the evil maid attack (and that's why I'm commenting, not answering :)). I just linked to Truecrypt's answer to why they don't consider it worth pursuing. Coming back to the question - the 'evil maid' can replace or intercept your keyboard controller or DIMMs, rendering TPM+PIN vulnerable to the evil maid attack. Boot path tampering may not work, but that's not the only worry in this scenario - you don't gain all that much extra security against an attacker physically present.
    – Bob Watson
    Commented Feb 13, 2013 at 7:45
  • 1
    (Just realised I may be importing the term 'evil maid' from the physsec world, where I've heard it referring to any physical compromise. Looks like you mean the specific evil maid attack by Invisible Things? If so - my apologies.)
    – Bob Watson
    Commented Feb 13, 2013 at 7:55

2 Answers 2

Reset to default
2

Bitlocker is vulnerable to much the same attack.

This paper describes an attack against the PIN: "At the next boot, the MBR boot loader loads this file and transfers control to it. A fake BitLocker prompt is displayed (see figure 1); the entered PIN is stored in the NTFS partition, the original MBR is restored and the system rebooted. Later, the entered PIN can be read from the NTFS partition."

The major finding: "Using a TPM for key management in a straightforward way provides only very limited protection against a dedicated attacker. None of our attack strategies targets the TPM as such. They all exploit the way it is being used by one particular implementation of disk encryption". Which leads me to believe that TPM is not, in principle broken, but that we have yet to develop a system secure against an adversary who is physically present.

Improve this answer
3
  • As we established in the question's comments, this doesn't answer my actual question. The paper is on point, and is a decent survey of plausible attack strategies. However, it only confirms what I already understood: Boot path tampering is detectable by the user when using Bitlocker with "PIN + TPM". My original question of how to simulate such boot path tampering for testing, however, remains.
    – alx9r
    Commented Feb 14, 2013 at 1:48
  • I'm not sure if there's a difference between 'simulate' and 'perform the attack' - why not attempt the TPM+PIN attack in the article, and compare with the Invisible Things attack?
    – Bob Watson
    Commented Feb 14, 2013 at 1:50
  • 'performing the attack' would work just as well for my purposes. I've been hunting for an image of the "specially prepared USB drive" apparently used in the article, without success. I'd like to attempt the attack in the article, but without an image that is pretty tough.
    – alx9r
    Commented Feb 14, 2013 at 2:20
1

You can perform your own boot path tampering by making a trivial edit of the system reserved volume (SRV).

enter image description here

You'll have to use bootable media with some software capable of volume editing -- Windows seems to protect the SRV that was used to boot. I used an Acronis Disk Director boot CD to accomplish this edit:

enter image description here

Upon reboot, BitLocker yielded this screen:

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .