Slashdot Mirror
Holding Shift + F10 During Windows 10 Updates Opens Root CLI, Bypasses BitLocker (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: Windows security expert and infrastructure trainer Sami Laiho says that by holding SHIFT + F10 while a Windows 10 computer is installing a new OS build, an attacker can open a command-line interface with SYSTEM privileges. This CLI debugging interface also grants the attacker full access to the computer's hard drive data, despite the presence of BitLocker. The CLI debugging interface is present when updating to new Windows 10 and Windows 10 Insiders builds. The most obvious exploitation scenario is when a user leaves his computer unattended during the update procedure. A malicious insider can open the CLI debugger and perform malicious operations under a root user, despite BitLocker's presence. But there are other scenarios where Laiho's SHIFT + F10 trick can come in handy. For example when police have seized computers from users who deployed BitLocker or when someone steals your laptop. Windows 10 defaults help police/thieves in this case because these defaults forcibly update computers, even if the user hasn't logged on for weeks or months. This CLI debugging interface grants the attacker full access to the computer's hard drive, despite the presence of BitLocker. The reason is that during the Windows 10 update procedure, the OS disables BitLocker while the Windows PE (Preinstallation Environment) installs a new image of the main Windows 10 operating system. "This [update procedure] has a feature for troubleshooting that allows you to press SHIFT + F10 to get a Command Prompt," Laiho writes on his blog. "The real issue here is the Elevation of Privilege that takes a non-admin to SYSTEM (the root of Windows) even on a BitLocker (Microsoft's hard disk encryption) protected machine." Laiho informed Microsoft of the issue and the company is apparently working on a fix.
Someone tell this guy that launching any Windows install DVD in repair mode allows you to do such amazing things as replace the sticky keys executable with cmd.exe, allowing anybody with physical access to launch a command prompt from the login screen by pressing shift a couple times.
Surely that's not good! Such behaviour is only justified if the software developer refuses to do anything about it
Microsoft is finally backing away from their focus on privacy invasion in Win10 and going back to concentrate on their core competency, lack of security.
I was really starting to get worried. Whew.
ya, funny how that works, and yet updating takes far far less time. It makes me think bitlocker is faking the encryption phase. Time to bitlocker a drive and then stick it on a linux system and see what I can see.
At least from Windows 7 you could've opened that console from almost every phase of the setup. A new Dell laptop turning on for the first time can be "broken in" the same way. You can insert a backdoor and sysprep it back to the "first-run" state, if you wish so. It's all documented. (I know, physical access, etc.)
It has now became a problem because Windows 10's "big updates" are basically running the full setup of a new system build while migrating the user data. This actually invokes the standard Windows setup 'upgrade' on your live system.
$5 says they are just rot13ing it.
...
The reason why is the key is stored on the TPM chip. NTFS.sys can simply use it as a layer in it's I/O stack when filling it's read/write buffers.
http://saveie6.com/
you can boot the system from a USB and do whatever you want.
This just means that bitlocker is fake security
BitLocker can be used without TPM. You can supply your key via a USB drive or even use a keyboard to put in the 48-digit recovery key.
It would take you the same amount of time to read the entire HDD back out using this exploit.
(Assuming the read and write performance of your drive are roughly the same.)
Further, it took you hours to encrypt your drive because it wasn't OPAL v2 compliant and couldn't talk nicely to BitLocker.
OPAL v2 drives simply use the same key in their hardware for BitLocker, so you're not double encryption and you don't need to run a pass over the whole drive when you turn it on. Turning it off just drops you back down to hardware encryption on the drive (which is completely useless unless you lock the drive with the manufacturer's tool / require a power on password, or later perform a secure erase which will just nuke the key and reset the various tables in the controller).
Shift-F10 has existed for lots of years know. Requires physical access. Windows build updates require to decrypt the drive.
Open Source Java Web Forum with LDAP authentication
but you can't get the data easy with the out the bit locker key. Systems with TPM can auto unlock bit locker and boot to the login screen if set that way.
Is this really surprising? From the company that just made accepting every update they want to push mandatory? I didn't trust Microsoft before they did that, now it's just blatant in your face "we own your computer". The fact that anyone trusts BitLocker is what astounds me.
Your Windows 10 friends are:
1) Windows Update Mini Tool. Gives you back control of your windows update experience.
2) Windows updates details. A spreadsheet maintained with every patch and what it does. Microsoft gets more and more evasive with their explanations of what their patches do, this is a good site for info. And, for heaven's sake, please please please get...
3) VeraCrypt. Based on TrueCrypt 7.1, development was continued by the community. Security audits have been done on this code base and, while no non-trivial software can ever be proven completely safe, I trust this software far more than BitLocker (which I actively distrust).
My Windows 7 laptop was safe from the whole Windows 10 upgrade debacle and the "we are going to upgrade your OS unless you happen to catch this message in time and say no" nagware because I carefully and meticulously have always gone over every windows update that goes on my computer. It was with literal astonishment that I learned that update is mandatory in Windows 10. I can't believe people stand for it. I've managed to work around it, but that was really the last straw for me. I have finally migrated mostly to Linux. I have used it for my servers and personal cloud services since the days of SLS but never really adopted for my desktop. I kept it for stuff I couldn't do in Windows. Now I've reversed that, using Linux for everything I can and only using Windows for gaming or software I absolutely can't do in Linux.
Some updates are like a full upgrade in place install with the full installer pre boot system in place. It's not like the small updates / old SP's
If you are doing BitLocker correctly, you have to type in a password every time you boot the computer. If you are doing is really right, that password is only a PIN used to unlock the actual encryption key stored in a Trusted Platform Module (hardware protected crypto storage device). This means that although a computer may update itself automatically if it gets powered up by an adversary, thus opening an opportunity for the diagnostic shell to have access to a temporarily disabled BitLocker, this could only happen if the adversary knows (or can coerce) the BitLocker password from you. While some may believe that there is a backdoor to BitLocker, this particular diagnostic window is not it because it should never be accessible by an adversary.
Just who is going to be at the keyboard during this vulnerability? The PC owner.
No, the person with physical possession of the PC, which could be the person who stole it. Many computers are worth far less than the data they contain.
Because the article does not say and that would be the one critical piece of information. Seems to be more people that report without any understanding because otherwise that piece of information would have been in there. Now, getting SYSTEM, but BitLocker protected data is inaccessible is no big deal: Just boot a recovery CD to get the same. If, on the other hand, this allows really bypassing BitLocker (which protects data, _not_ the boot process) meaning access to encrypted data without the password, then BitLocker would have a big bad obvious backdoor. I somehow doubt that is the case.
My money is on shoddy, sensationalist and utterly worthless reporting which has become so common these days.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You can get an administrative shell by booting from installer media and pressing Shift+F10 without ever kicking of an install or upgrade. I typically use this to run diskpart to create a VHD to try out new Windows Insider builds via multiboot without borking my primary OS installation.
There is no security without physical security. Typing a Bitlocker key to unlock your drive before booting may be a PITA but its worth it if you value your privacy.
Only if it's in an AD environment and joined to a domain controller, and even then the domain administrators have control of your updates, not you. Otherwise for home users it just starts automatically; the only requirement is for the machine to be turned on so that it can apply a new update. And that's the whole point of this: If the NSA (or whoever) wants to eventually decrypt your bitlocker encrypted HDD without any need for brute force tactics, all they have to do is wait for a new major patch from MS (which at the current rate happens about every 6 months) and they have a perfect opportunity to decrypt your entire HDD. That's well within the statute of limitations for ANYTHING they'd be interested in nailing you for, even for petty crimes like shoplifting.
BTW that's an interesting way for a GNAA post to be upmodded.
I don't know why, but my system never reboots to install the next build and I use the insider builds. Have way too many other bugs I actually want fixed to report it though.
No. Spooks and (when allowed) the police have been given the keys to Bitlocker by Microsoft. It does not stop institutional hackers.
There's every reason to believe that foreign state actors have acquired similar capabilities by some means.
Ummm, did you read the summary?
There are two types of people in the world: Those who crave closure
MSFT: Now in the business of making sure the government doesn't need to send out your hard drive to a nameless forensics company.
Just run update.exe, hit Shift+F10, boom goes the dynamite.
There are two types of people in the world: Those who crave closure
Or the guy who just ran update.exe.
There are two types of people in the world: Those who crave closure
28th May 2014 Truecrypt says 'switch to Bitlocker'
Well, it's lucky we didn't!
One of the basic rules of all engineering, but especially software, is that most bugs are as a result of genuine oversight not incompetence. In the case of Windows, which is a massively complex concoction, it is not a surprise when something weird is found. The test in these circumstances is how much effort the organisation who made the mistake puts into resolving it, not how bad the mistake it.
It might be caching the encryption key on disk during the update to avoid the user having to enter their password to decrypt every reboot (if that's how bitlocker works, I've never actually used it)
but, how is this news? You can Shift + F10 to get a CLI using a Windows 10 install disk locally too (written, on Windows 10, at work).
Given that you have to have physical access to the machine to do this then this being an exploit is the least of your worries and your security failed long before the keyboard was touched.
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
So, is that double as in 2 ROT13s of the data?
Either the bypass demonstrated here authenticates in some way
The updater probably just suspends Bitlocker protection during the reboot. This makes the volume encryption key temporarily available without authentication. An administrator can do the same thing by suspending Bitlocker from the command line.
I assume the updater will automatically reenable protection once the installation completes.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
You obviously have no idea how Bitlocker works. It is architecturally similar to many other full-disk encryption packages.
There is a volume encryption key which is used to encrypt the user data on the disk. This key is generally used with a fast symmetric cipher like AES. Once the initial volume encryption is completed, all reads/writes require the key to encrypt or decrypt the data.
The volume encryption key is encrypted with the public key or password for each unique user. Thus, each user has his own means of accessing the volume key, which must be the same for everyone. There is an encrypted copy of the volume key on the hard drive for every user. It could be one, or it could a hundred. (In most enterprises, the TPM is also a "user" who can unlock the drive with its key.)
In this case, the disk can be temporarily "unlocked" if an administrator suspends Bitlocker. When Bitlocker is suspended, the volume encryption key is stored in a cleartext container on disk. That volume will automatically unlock until Bitlocker protection is reenabled, which scrubs the cleartext key.
Microsoft should require administrator consent before suspending Bitlocker, so this is more of a design flaw than an exploit. Manually suspending Bitlocker does require administrator privileges.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Bitlocker can use a public/private key pair or a password to protect the volume encryption key.
The TPM's private key does not have to be given access to the volume encryption key. It can be kept on a USB drive.
Or it can be used with only a password, and then the only means of unlocking the drive is inside your head.
Key protectors can be added/removed via the command line. It takes less than a minute.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
I have to say it, I'm sorry. Glancing through the comments, I read your title as "Only the lazy terminals..."
Have to throw that one out there. :)
It's been a publicised setup feature since at least Windows 2000, WIndows XP and Windows Server 2003!
Description of the Windows Setup Function Keys
https://support.microsoft.com/...
Useless. McAfee is still there popping out consoles after they blocked me in FB and their software ran out of subscription.