Bitlocker - false positive

[garatc]

Hi there,

I've just had two cases where Bitlocker was enabled with a PIN but the tool yielded a medium risk along with the following description: "BitLocker is enabled. A second factor of authentication (PIN, startup key) is not explicitly required."

Am I missing something or is there something potentially wrong with this detection item? Happy to help if further investigation is required

Cheers

[itm4n]

Yes! Both statements are correct. :)

The script just checks whether the policy for enforcing a PIN is configured or not. It does not tell you whether a PIN is actually set. The case you describe is very common. It's what I've observed as well many times.

Unfortunately, I haven't found a way to determine whether a BitLocker PIN is set without admin privileges. The only thing I found is this policy, but it is rarely used I suppose. So, it's not a good indicator.

Without a better solution, I left it like this. Of course, if you or someone else finds a way to get that information as a low privilege user, I'd be more than happy to implement it in the script. It's something that is bothering me as well. :/

[Sw1ss4lps]

manage-bde -status C: 😄

[garatc]

Yes! Both statements are correct. :)

The script just checks whether the policy for enforcing a PIN is configured or not. It does not tell you whether a PIN is actually set. The case you describe is very common. It's what I've observed as well many times.

Unfortunately, I haven't found a way to determine whether a BitLocker PIN is set without admin privileges. The only thing I found is this policy, but it is rarely used I suppose. So, it's not a good indicator.

Without a better solution, I left it like this. Of course, if you or someone else finds a way to get that information as a low privilege user, I'd be more than happy to implement it in the script. It's something that is bothering me as well. :/

Thanks for the quick response!

I just spent an hour trying to find a solution myself, and haven't found any real way. Either access is denied (manage-bde, WMI calls, bcdedit,...) or results aren't consistent, e.g., with event logs or registry values. Something is bothering me though, if you browse through the Bitlocker UI of a PIN-protected Windows 11, you know for a fact that a PIN is configured because you can see that there's an option to "modify your PIN code". So the UI with your user token knows that information, and I have no idea how

PS: this is definitely nothing important obviously, I don't think it is crucial to be able to script it since most of the time we have physical access anyway. But it's still interesting :)

[itm4n]

You're right. I think you're onto something here. I'll try to search in that direction to see how the UI is able to make this distinction.

It is not super important indeed, but still, if I can produce accurate results, I'd rather do it as far as possible. :)

[itm4n]

So, I ended up partially reverse engineering the BitLocker API. What I found is fascinating. It turns out many things can be done as a low privilege user.

Most importantly, I found how the BitLocker UI retrieves the type of authentication and displays it. I made a PoC in C/C++ and tested it on 3 VMs, one without BitLocker encryption, one with TPM, and one with TPM+PIN. I'm able to get the correct status in all cases. Still need to port the code to PowerShell and integrate that into the script, though, but that's the easy part. :P

[garatc]

Amazing! I spent some time on it as well and could see that some exports can be called as a low privilege user, but I am trash at reverse engineering and quickly gave up for the night. I would be very interested in chatting about it though, if you're on any platform!

[itm4n]

My main platform is Mastodon currently. I'm also on Twitter/X, Bluesky, Discord, but I rarely (if not never) check those these days. Anyways, I think I'll write a short blog post about it because there are some interesting and unusual bits about this particular API.

[itm4n]

FYI, I uploaded a PoC here: https://github.com/itm4n/Pentest-Windows/tree/main/BitLockerFveApi

The blog post will most likely follow next week. I still need to port the C code to PowerShell, and most importantly refactor the current BitLocker check.

[itm4n]

This should be fixed with commit 1a10429.