Windows BitLocker can be broken in 43 seconds on an old PC using a simple Raspberry Pi Pico

When Microsoft presents us with an encryption system that requires highly specific hardware and advanced knowledge to circumvent, we are entitled to believe it. However, BitLocker has a major weakness, related to the design of certain computers. In fact, for it to work, it requires a link between the device's CPU and the TPM chip connected to the motherboard, which is a communication path that is…unprotected.

This has just been proven by YouTuber Stacksmashing, a cybersecurity researcher. On some motherboards, easily accessible connectors allow you to read data transferred between the two components. Using a few well-placed probes, it was able to retrieve the encryption information needed to read data from the SSD when the computer started.

The tool used in this process is none other than a Raspberry Pi Pico, available for sale in France for less than 6 euros, connected to a printed circuit that enables it to be ordered for a few dollars. The latter allows the use of spring-loaded contacts, which are used to connect to relatively prominent and easily accessible connectors on the motherboard. According to stacksmashing, all of these components will cost him $10.

No soldering needed here, as the encryption key used by BitLocker can be recovered quickly, within 43 seconds on an assembled and running computer.