Field Guide To Physical Attacks Against Full-disk Encryption

This talk surveys how an attacker with physical access can defeat BitLocker, the Windows full-disk encryption product. The speakers explain the key hierarchy, where a volume master key is sealed by key protectors and the TPM releases it at boot only when measured values in registers such as PCR 7 and 11 match expected ones. They present the session as an aggregation of existing research and say they do not advise against BitLocker when it is configured properly.

Attack routes covered include recovery keys exposed through cloud directory accounts, memory extraction over DMA with a hardware device, and the Bit Pixie boot-manager weakness that abuses an outdated, vulnerable boot manager served over the network. The most reliable method is sniffing unencrypted traffic on the SPI bus between the TPM and the processor, clipping a logic analyzer to the BIOS chip and decoding frames to recover the volume master key. A live demo recovered the key, mounted the protected drive on Linux, and outlined post-exploitation options such as resetting local credentials.

For defenders, mitigations include enabling pre-boot DMA protection, tightening recovery key access in the cloud directory, and requiring TPM plus PIN, which blocks most reboot-based attacks but not an insider who knows the PIN. Chassis intrusion protection was judged easy to bypass, and detection is hard because these attacks leave little trace. Future TPM parameter encryption may counter bus sniffing.