CypherCon 2026

Bypassing BitLocker: Full Disk Decryption for less than $5

Allen & Dale Cook

Abstract:

Trusted Platform Modules (TPMs) are a core part of platform security and are required by Windows 11 for features such as BitLocker full disk encryption. Few people understand how TPMs are actually implemented and the potential vulnerabilities that come with them.
In this talk we’ll cover how TPMs work, how bus sniffing can be used to leak secrets like Volume Master Keys (VMKs), and what can be done to prevent these attacks. We’ll also demo an affordable VMK extraction tool that we’ll use to bypass BitLocker protection.

Allen & Dale Cook

Brothers who are just regular brothers running in a van from an asteroid and all sorts of things

Allen Cook is a security engineer with an interest in the practical application of offensive security, focusing on how real attackers operate and how systems actually break.

Dale Cook is a security researcher with experience in hardware, firmware, and software hacking. In his free time, Dale likes using technology to solve problems that arguably don’t need to be solved.