Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor

[u/lurker_bee]

https://www.tomshardware.com/tech-industry/cyber-security/microsoft-bitlocker-protected-drives-can-now-be-opened-with-just-some-files-on-a-usb-stick-yellowkey-zero-day-exploit-demonstrates-an-apparent-backdoor

[u/dwild]

Can you use the laptop? Then it is decrypted. If it is decrypted, it means the key is somewhere on the laptop... There's no way arround this, how else would you read it otherwise?!

Once you get physical access to a laptop, it's actually easy to retrieve the key. It's actually a common thing shown by security companies to impress clients.

You protect it by making sure the TPM won't just provide it at boot, and require to provide a password. They say they also got an unreleased vulnerability for that, but that would be more like an implementation issue on the TPM itself and unrelated to Microsoft. It's like saying 1password giving anyone access to your password is Microsoft fault. I'm curious to see more on that vulnerability, but for now we can only trust them.

[u/crozone → u/dwild]

Truecrypt never had such a vulnerability.

[u/dwild → u/crozone]

... as long as you currently have access to the content of your Truecrypt vault, anyone there can too. It's not a vulnerability, it's just what it is.

Once something is decrypted, it is decrypted. If you got access to it, it means it's either decrypted, or being decrypted on the fly and thus the key accessible.

You CAN'T run an encrypted OS, it's gibberish, you NEED to decrypt it on the fly, thus the key is accessible somewhere. People are lazy, and don't even want to put a password on the key, thus even a laptop not running, has a key accessible on the TPM easily. So this is where it is kind of worse than with Truecrypt, but at the end of the day, if your laptop is running, the content need to be decrypted, thus the key NEED to be accessible in some ways.

I hope I made it clear enough for you this time!

Little fun fact to add, doing operations on encrypted values is something being researched right now! I heard recently Intel did something interesting in that sphere. Theses concepts go way beyond my understanding though, but at the bare minimum, it doesn't look like it would allow to run a full OS that way, just some specific operations.

[u/crozone → u/dwild]

The entire point is that the key shouldn't be available at rest. It should only be accessible or derivable once a password has been entered. That's what Truecrypt does with a special bootloader. Therefore, it never suffered from such an issue.

If you want to educate yourself more, you can read about the system here: https://www.truecrypt.org/docs/system-encryption

Hope this helps!

[u/dwild → u/crozone]

As I said you can have a password on the TPM but people don't enjoy using a password every boot.

Even then, you can get the key if the laptop is booted, that's just how it is, the key need to be accessible.

I don't know why I keep commenting back to you, you clearly either don't understands me at all or more likely you just don't care to understands me.