Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker protected drive without physically tampering with the PC (such as hardware keyloggers)?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is completely turned off when you store it (hibernate is also ok, but sleep needs to be disabled).

share|improve this answer
3  
Note that cold boot attacks are not specific to BitLocker, but can attack any of the commonly used disc encryption systems. There has been some efforts to keep the encryption key out of the RAM, like TRESOR (www1.informatik.uni-erlangen.de/tresor), but those are not ready for productive use yet. –  Perseids Aug 11 '13 at 16:31
    
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network. –  this.josh Aug 12 '13 at 6:35
add comment

There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html

The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for a few minutes when it is unattended (for example, in your hotel room, hence the name) and loads a hacked bootloader into it. You then log in with your password via the hacked boot loader and it unlocks the drive, but also writes your password to a .txt file in the unencrypted part of the HDD. You leave your laptop alone again, they steal it with the password.

share|improve this answer
    
I use an SSD as a system drive, and then I have another drive for my files. I planned to leave the SSD unencrypted and only encrypt the HDD which holds the important stuff. Does that make the HDD secure? –  astralbanana Aug 12 '13 at 20:09
add comment

There are two answers: No and Yes.

First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered.

Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a Microsoft product. In times of PRISM and NSA you shouldn't really trust them.

TIP: Use a free OS like Fedora and glue your RAM to it's banks.

share|improve this answer
1  
I guessed that because it's a Microsoft product, there could be any kinds of backdoors for NSA. Even though I might not have anything seriously illegal on my HDD, it's just a matter of principle. I guess TrueCrypt would be better option. –  astralbanana Aug 11 '13 at 17:45
    
@astralbanana What makes you believe Truecrypt is better? The Linux kernel itself had backdooring potential with the RdRand code that Linus Torvalds included. –  Luc Aug 11 '13 at 19:55
    
@Luc I'm more confident trusting it since it's open-source, instead of being developed by a huge company that certainly has connections to agencies that would have a motivation to request backdoors. –  astralbanana Aug 12 '13 at 17:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.