-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----------------------------------------------------------------------
[ iViZ Security Advisory 08-001                            25/08/2008 ]
- -----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
                                            http://www.ivizsecurity.com
- -----------------------------------------------------------------------

* Title:     Microsoft Bitlocker Plain Text Password Disclosure
* Date:      25/08/2008
* Software:  Microsoft Bitlocker

- --[ Synopsis:

    Bitlocker is the disk encryption feature introduced in Microsoft
    Vista. It has the capability to authentify users in several way,
    including with a password (PIN), when configured to work with the
    TPM chip.

    The password checking routine of Microsoft Bitlocker fails to
    sanitize the BIOS keyboard buffer after reading passwords, resulting
    in plain text password leakage to unprivileged local users.

- --[ Affected Software:

  * Microsoft Bitlocker/Vista (SP0)

- --[ Non Affected Software:

  * Microsoft Bitlocker/Vista (SP1)

- --[ Technical description:

    Bitlocker's pre-boot authentication routines use the BIOS API to
    read user input via the keyboard. The BIOS internally copies the
    keystrokes in a RAM structure called the BIOS Keyboard buffer
    inside the BIOS Data Area. This buffer is not flushed after use,
    resulting in potential plain text password leakage once the OS
    is fully booted, assuming the attacker can read the password at
    physical memory location 0x40:0x1e.


- --[ Impact:

    Plain text password disclosure. Local guest access is required,
    but no physical access to the machine.

- --[ Full Technical Whitepaper

    http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf

- --[ Vendor response:

  * Microsoft Bitlocker Team has aknowledged the vulnerability.
    This vulnerability is fixed in Microsoft Windows Vista (SP1)

- --[ Credits:

    This vulnerability was discovered by Security Researcher
    Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.

- --[ Disclosure timeline:

  * First private disclosure to vendor on May 27th 2008
  * First vendor reply on May 30th 2008
  * First Public disclosure at Defcon 16 on August 10th 2008

- --[ Reference:

    http://www.ivizsecurity.com/security-advisory.html



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFIsnLckcchhz1mT/IRAt3yAKCRa6HsWk2T7B3M1o8zzgNgN+h37wCaA0rT
WOsiqhwTaGktSAz1mJ8wdgY=
=pEvb
-----END PGP SIGNATURE-----