Attacking Windows Authentication and BitLocker Full Disk Encryption

No ratings

Presented at BsidesSeattle 2016 by

Ian Haken

In November 2015, I presented the details of a vulnerability in Windows authentication allowed for an attacker with physical access to bypass authentication and access a user's data even if it had been protected with BitLocker full disk encryption. I will describe the details of how BitLocker works, how Windows performs domain authentication, and how this vulnerability (patched as part of security bulletin MS15-122) allowed an attacker to bypass these security protocols. New in this presentation, I will also show how this vulnerability can be used to opportunistically infect unattended (but locked) machines using an automated, portable attack tool and how an attacker can cover their tracks when exploiting this vulnerability.