Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker protected drive without physically tampering with the PC (such as hardware keyloggers)?

share|improve this question

8 Answers 8

up vote 3 down vote accepted

There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is completely turned off when you store it (hibernate is also ok, but sleep needs to be disabled).

share|improve this answer
5  
Note that cold boot attacks are not specific to BitLocker, but can attack any of the commonly used disc encryption systems. There has been some efforts to keep the encryption key out of the RAM, like TRESOR (www1.informatik.uni-erlangen.de/tresor), but those are not ready for productive use yet. –  Perseids Aug 11 '13 at 16:31
    
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network. –  this.josh Aug 12 '13 at 6:35
    
→ Lucas, you are answering on the physical access risk & the OQ is focused on this risk. But this is the "north face" for heroes & I-agencies. –  daniel Azuelos Jul 7 '14 at 21:00

There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html

The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for a few minutes when it is unattended (for example, in your hotel room, hence the name) and loads a hacked bootloader into it. You then log in with your password via the hacked boot loader and it unlocks the drive, but also writes your password to a .txt file in the unencrypted part of the HDD. You leave your laptop alone again, they steal it with the password.

share|improve this answer
    
I use an SSD as a system drive, and then I have another drive for my files. I planned to leave the SSD unencrypted and only encrypt the HDD which holds the important stuff. Does that make the HDD secure? –  astralbanana Aug 12 '13 at 20:09

There are two answers: No and Yes.

First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered.

Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a Microsoft product. In times of PRISM and NSA you shouldn't really trust them.

TIP: Use a free OS like Fedora and glue your RAM to it's banks.

share|improve this answer
2  
I guessed that because it's a Microsoft product, there could be any kinds of backdoors for NSA. Even though I might not have anything seriously illegal on my HDD, it's just a matter of principle. I guess TrueCrypt would be better option. –  astralbanana Aug 11 '13 at 17:45
1  
@astralbanana What makes you believe Truecrypt is better? The Linux kernel itself had backdooring potential with the RdRand code that Linus Torvalds included. –  Luc Aug 11 '13 at 19:55
1  
@Luc I'm more confident trusting it since it's open-source, instead of being developed by a huge company that certainly has connections to agencies that would have a motivation to request backdoors. –  astralbanana Aug 12 '13 at 17:11

If Windows is running, your drive mounted and hence unencrypted, and if your physical interfaces aren't protected against connection at the OS level, yes there are many ways to get your data out.

The biggest deception point is that this access to your BitLocker protected disk will be much easier through the network than through any physical direct access. As long as Windows is on, it is the "royal" entrance path. This weakness stands for any OS, not just Windows.

Just have a look at the number of bug fixed every month in every OS. Some security expert are today comparing OSes in terms of "bug throughput". And the leader is…

BitLocker software will bring you a real security against the theft of your computer if you strictly abide to the following basic rule:

As soon as you have finished working, completly shut off Windows and allow for every shadow of information to disappear (from RAM, disk caches…) within 2 minutes.

share|improve this answer
    
That isn't true. As long as you can boot into Windows (i.e. be prompted to enter your user account password), the Bitlocker keys are already in RAM. When you enter your user crendentials to log into Windows, Windows will hash your password and compare it to the existing hash (which has already been decrypted by Bitlocker). Therefore, an attacker can simply start your computer. To mitigate against this, you may have a pin+TPM, and shut off Windows as you said. However, only certain devices are susceptible to Cold Boot and DMA. Google "Building a Bulletproof Bitlocker" for more info. –  kevinze Jan 13 at 12:05

Bitlocker certainly isn't because they have law enforcement power point presentations saying they can gain access to it and you certainly don't see the Fed pressuring MS anymore like they are other groups encrypting. Stay open source and research.

http://www.techarp.com/showarticle.aspx?artno=770&pgno=3

share|improve this answer
1  
I'll bite. Assume for a minute that the U.S. govt did manage to backdoor the systems called out in that presentation. Knowledge of this would be highly classified and wouldn't be shared with some county sheriff's office in Oregon. Your source is highly suspect. –  Levi Oct 3 '14 at 6:52
    
I agree, I think Microsoft has the key according to howtogeek.com/199171/… –  hardywang Dec 29 '14 at 15:27

Elcomsoft Forensic Disk Decryptor promises to :

"offer investigators a fast, easy way to access encrypted information stored in crypto containers created by BitLocker, PGP and TrueCrypt."

What's scary, is that this software can be purchased by anyone.

I believe this confirms that there is NO SECURE MEANS OF ENCRYPTING A DISK.

share|improve this answer
    
... given certain conditions. Read the section on how it acquires the encryption keys. –  schroeder Jul 7 '14 at 20:39
1  
"In order to obtain the decryption keys, the encrypted volume must be mounted on the target PC." –  daniel Azuelos Jul 7 '14 at 21:08
    
I tested it multiple time but it was not able to hack my TrueCrypt and Bitlocker drive. Complete bullshit company! Use strong passwords and keys larger then 2048. They, and the NSA will not get in! A company promising it can decrypt PGP or Bitlocker is untrustworthy. Even the NSA is still not able to decrypt PGP!! –  Digital Human Jan 14 at 8:04

Perhaps you can see my question for some related comments on Bitlocker. I recommend Sami Laiho's talk on Building a Bullet Proof Bitlocker.

In general, Bitlocker is secure and is used by companies all over the world. You can't just extract keys out of the TPM hardware. Evil maid attacks are mitigated also since TPM will validate the pre-boot components to make sure that nothing has been tampered with. Booting into another OS like Linux to extract passwords or the data will not be possible also, since the TPM will not release its keys if it sees you're booting into another OS (even if it is another Windows OS).

If you pass the TPM's integrity check, then the keys will be released to be used for on-the-fly encryption and decryption. Failing which, you get a Bitlocker recovery key lockout, and must supply the recovery key in order to unlock the drive. The attacker should not be in possession of this key. Therefore, never put both the recovery key and your computer together.

Some answers alluded to various forensic tools. However, I am personally not convinced that they work on all systems. For example in TrueCrypt, the key is actually derived from the password which the user keys in. You cannot feasibly brute force AES. As for Bitlocker, the TPM is a hardware solution that stores the key. You can't extract the key with software.

share|improve this answer

bitlocker is closed source and made by microsoft.. so take that for what its worth

truecrypt is used by amazon

that said, the real answer is that there is no secure encryption software for windows, Some people have built truecrypt from source (you can too if you have a lot of time to waste) so it is not secretly backdoored, but that said, theres no security audits, one was being attempted, but who knows about that. Its secure enough for average use though, because the US hasn't been able to break it, and they have tried with high stakes (see that south american bankster)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.