full-disclosure - Re: [IVIZ-08-001] Microsoft Bitlocker Plain Text Password Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4024101.2854721219786648746.JavaMail.juha-matti.laurio@netti.fi>
Date: Wed, 27 Aug 2008 00:37:28 +0300 (EEST)
From: Juha-Matti Laurio <juha-matti.laurio@...ti.fi>
To: full-disclosure@...ts.grok.org.uk, 
	iViZ Security Advisories <advisories@...ztechnosolutions.com>
Subject: Re: [IVIZ-08-001] Microsoft Bitlocker Plain Text
 Password Disclosure

Any advisories, CVE available?

The following non-English advisory has been released:
https://www.cert.dk/nyheder/nyheder.shtml?08-08-26-11-14-00

Juha-Matti

iViZ Security Advisories [advisories@...ztechnosolutions.com] wrote: 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> - -----------------------------------------------------------------------
> [ iViZ Security Advisory 08-001                            25/08/2008 ]
> - -----------------------------------------------------------------------
> iViZ Techno Solutions Pvt. Ltd.
>                                             http://www.ivizsecurity.com
> - -----------------------------------------------------------------------
> 
> * Title:     Microsoft Bitlocker Plain Text Password Disclosure
> * Date:      25/08/2008
> * Software:  Microsoft Bitlocker
> 
> - --[ Synopsis:
> 
>     Bitlocker is the disk encryption feature introduced in Microsoft
>     Vista. It has the capability to authentify users in several way,
>     including with a password (PIN), when configured to work with the
>     TPM chip.
> 
>     The password checking routine of Microsoft Bitlocker fails to
>     sanitize the BIOS keyboard buffer after reading passwords, resulting
>     in plain text password leakage to unprivileged local users.
> 
> - --[ Affected Software:
> 
>   * Microsoft Bitlocker/Vista (SP0)
> 
> - --[ Non Affected Software:
> 
>   * Microsoft Bitlocker/Vista (SP1)
> 
> - --[ Technical description:
> 
>     Bitlocker's pre-boot authentication routines use the BIOS API to
>     read user input via the keyboard. The BIOS internally copies the
>     keystrokes in a RAM structure called the BIOS Keyboard buffer
>     inside the BIOS Data Area. This buffer is not flushed after use,
>     resulting in potential plain text password leakage once the OS
>     is fully booted, assuming the attacker can read the password at
>     physical memory location 0x40:0x1e.
> 
> 
> - --[ Impact:
> 
>     Plain text password disclosure. Local guest access is required,
>     but no physical access to the machine.
> 
> - --[ Full Technical Whitepaper
> 
>     http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
> 
> - --[ Vendor response:
> 
>   * Microsoft Bitlocker Team has aknowledged the vulnerability.
>     This vulnerability is fixed in Microsoft Windows Vista (SP1)
> 
> - --[ Credits:
> 
>     This vulnerability was discovered by Security Researcher
>     Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.
> 
> - --[ Disclosure timeline:
> 
>   * First private disclosure to vendor on May 27th 2008
>   * First vendor reply on May 30th 2008
>   * First Public disclosure at Defcon 16 on August 10th 2008
> 
> - --[ Reference:
> 
>     http://www.ivizsecurity.com/security-advisory.html
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (MingW32)
> 
> iD8DBQFIsnLckcchhz1mT/IRAt3yAKCRa6HsWk2T7B3M1o8zzgNgN+h37wCaA0rT
> WOsiqhwTaGktSAz1mJ8wdgY=
> =pEvb
> -----END PGP SIGNATURE-----
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/