Encryption & Key Management
,
Security Operations
Researcher Demonstrates Bitpixie Attack Tactics to Extract Encryption Key
A previously patched flaw in Windows BitLocker disk encryption feature is susceptible to attacks allowing hackers to decrypt information, new research has found.
See Also: Cracking the Code: Securing Machine Identities
Speaking at the recently concluded Chaos Communication Congress in Germany, security researcher Thomas Lambertz said a Microsoft patch for a medium severity flaw tracked as CVE-2023-21563 doesn’t fully prevent attacks. Contrary to Microsoft’s analysis, the flaw can be exploited over the network, Lambertz also said.
“This is all network only,” Lambertz said about his exploit tactics. “All we had to do was plug a USB device and use PXE booting to exploit the flaw.”
Lambertz demonstrated the attack on a fully updated Windows 11 device using a tactic called “bitpixie” that exploits weaknesses arising from how Windows devices handle memory or encryption during booting and recovery processes.
By rebooting the device in recovery mode and running it in a downgraded version using a Windows bootloader, the researcher prompted the device to forget the encryption key.
Due to adequate mechanisms in place to revoke certification for older bootloader versions Lambertz said he obtained access to the system memory. He extracted data from the system memory including the master key to decrypt the data.
“The only thing that you can do to prevent this attack is to disable the full network stack in the BIOS. This way PXE booting is not possible no matter what you plug in,” Lambertz said.
Lambertz said Microsoft is aware of the issue and is struggling to strike a balance between adequate patching and ensuring security updates do not crash legacy devices.
“Microsoft is in this awkward position where every firmware update that they don’t predict correctly could break BitLocker. So they don’t do it,” Lambertz said.
While Microsoft is considering non-renewal of its current boot certification after its expiration in 2026, Lambertz added the proposed move could cause “chaos” as it would mean allowing the use of old, unsecured certificates. Microsoft did not immediately respond to a request for comment.