Tag Info

Hot answers tagged

8

Using the old martial art of Google-Fu I managed to find these two comments on the first and second page after providing the search parameters: "Bitlocker hibernation". From the Microsoft website: What are the implications of using the sleep or hibernate power management options? BitLocker on operating system drives in its basic configuration ...


8

Unlikely. It's AES-CBC-128, so there's no chance of you cracking the key. There are a few tools (e.g. Volatility, or Elcomsoft's forensics suite) that can recover the master key from a system memory dump, but that only works if the drive is already mounted and unlocked.


4

Yeah. There are many alternative to Truecrypt and BitLocker that you can find in link below: http://alternativeto.net/software/truecrypt/ However I software that meet you prerequisites are DiskCrypter and FreeOTFE(not supported anymore). P.S. there is no guarantee that they are backdoor free!


3

Linux can read and write data on BitLocker encrypted volumes using Dislocker, but that obviously requires the key. If you don't have the key, you can only read and write raw ciphertext (the encrypted partition), reading it won't give you anything useful (it just looks like random data), but writing on it will definitely corrupt the underlying NTFS partition ...


3

It's not possible to find arbitrary digits of the pin. It's an all-or-nothing deal. Assuming a numeric pin, there are 10,000,000 possible combinations. Depending on the implementation of the key derivation algorithm, it may take up to ~1s per attempt - that's roughly 58 days before you have a 50% chance of hitting the correct key, with 116 days (almost 4 ...


2

Best practice depends on what you are worried about. The danger of Sleep mode is that your key is still in memory, and can be extracted by an attacker with that expertise. Hibernation significantly reduces that risk in all scenarios. As Lucas Kauffman's answer indicates, using the advanced BitLocker implementation modes provides extra security, as well as ...


2

There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is ...


2

Bitlocker is vulnerable to much the same attack. This paper describes an attack against the PIN: "At the next boot, the MBR boot loader loads this file and transfers control to it. A fake BitLocker prompt is displayed (see figure 1); the entered PIN is stored in the NTFS partition, the original MBR is restored and the system rebooted. Later, the entered PIN ...


2

There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for ...


2

I don't know of independent security audits, but your questions 1-4 are relatively easily answered from official sources. I would have no reason to distrust the official sources on those matters. The quick answers are: Yes, the TPM is tamper-proof hardware which stores and protects your key. This is manufacturer dependent but most use an exponential ...


1

If Windows is running, your drive mounted and hence unencrypted, and if your physical interfaces aren't protected against connection at the OS level, yes there are many ways to get your data out. The biggest deception point is that this access to your BitLocker protected disk will be much easier through the network than through any physical direct access. ...


1

In the United States, the validation (certification) you looking for in government and some regulated areas is listed in the NIST Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules list. Per the FIPS 140-2 standard tamper based requirements start at Level 2. FIPS 140-2 Security Level 2: Security Level 2 enhances the physical security mechanisms ...


1

1) Yes, both are available. Databases can support field level, table level or full database security. They can also support externally controlled keys (provided by the client on connection to the DB) or DB managed keys (that are stored in the database and protected by the client's login credentials.) 2) Database encryption that doesn't apply to a live ...


1

This is a wild guess, but I would expect that it would depend on how you configure BitLocker when setting it up. If they allow you an option to backup the key when configuring it (which they should), then you could import that backup copy regardless of if it is exportable or not. If you don't have some backup copy of the key and it isn't exportable, I ...


1

There are two answers: No and Yes. First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered. Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a ...


1

I think I have found the "answer" to this. It should be possible, but Microsoft has not currently implemented it. As far as I know it is technically possible to have the decryption keys protected by several different TPMs stored on the same encrypted hard drive since they are (I think) a binary blob encrypted by the TPM, so each different TPM could have its ...


1

DPAPI functions basically two ways, either the info you're protecting is encrypted at a machine level, or a user level. If you're running as a service, you need to use machine level. If your running under a user, you can use the user level. The difference is that for the user level, the user's password basically provides the encryption for the data you pass ...



Only top voted, non community-wiki answers of a minimum length are eligible