Tag Info

Hot answers tagged

53

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


29

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


20

Once you enter your password the drive behaves just like any other unencrypted drive, as the encryption becomes transparent to the OS. If you share your drive and other users/computers have the required permissions to access it, they will be able to do so and won't even know the drive was encrypted. Full disk encryption is designed to protect from offline ...


20

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


9

Unlikely. It's AES-CBC-128, so there's no chance of you cracking the key. There are a few tools (e.g. Volatility, or Elcomsoft's forensics suite) that can recover the master key from a system memory dump, but that only works if the drive is already mounted and unlocked.


8

Boot Process Secure Boot There are quite a few steps to booting Windows 8. Now secure boot in general means that the boot loader is only run if its integrity can be checked. In this case, if enabled, the UEFI is started before anything else and checks that the boot loader is signed by a trusted Certificate Authority. For an operating system generally ...


8

Using the old martial art of Google-Fu I managed to find these two comments on the first and second page after providing the search parameters: "Bitlocker hibernation". From the Microsoft website: What are the implications of using the sleep or hibernate power management options? BitLocker on operating system drives in its basic configuration ...


5

There is currently only one cold boot attack I know of that works against bitlocker. However it would need to be executed seconds after the computer has been turned off (it can be extended to minutes if the DRAM modules are cooled down significantly) but due to the timeframe of execution it's rather implausible. Bitlocker is secure as long as your machine is ...


4

Yeah. There are many alternative to Truecrypt and BitLocker that you can find in link below: http://alternativeto.net/software/truecrypt/ However I software that meet you prerequisites are DiskCrypter and FreeOTFE(not supported anymore). P.S. there is no guarantee that they are backdoor free!


4

Disk encryption requires the host to keep or derive a master key which is kept somewhere in memory so that's your biggest issue. I've implemented aspects of the SafeNet ProtectFile product and other smart-card stacks so I'm intimately aware of the challenges. Don't for a minute think you have any real security. There are "digital forensic devices" that ...


3

No, it's not secure. You're vulnerable to: Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data) DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc. Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware. In general, if an ...


3

Linux can read and write data on BitLocker encrypted volumes using Dislocker, but that obviously requires the key. If you don't have the key, you can only read and write raw ciphertext (the encrypted partition), reading it won't give you anything useful (it just looks like random data), but writing on it will definitely corrupt the underlying NTFS partition ...


3

I don't know of independent security audits, but your questions 1-4 are relatively easily answered from official sources. I would have no reason to distrust the official sources on those matters. The quick answers are: Yes, the TPM is tamper-proof hardware which stores and protects your key. This is manufacturer dependent but most use an exponential ...


3

It's not possible to find arbitrary digits of the pin. It's an all-or-nothing deal. Assuming a numeric pin, there are 10,000,000 possible combinations. Depending on the implementation of the key derivation algorithm, it may take up to ~1s per attempt - that's roughly 58 days before you have a 50% chance of hitting the correct key, with 116 days (almost 4 ...


2

DPAPI functions basically two ways, either the info you're protecting is encrypted at a machine level, or a user level. If you're running as a service, you need to use machine level. If your running under a user, you can use the user level. The difference is that for the user level, the user's password basically provides the encryption for the data you pass ...


2

Best practice depends on what you are worried about. The danger of Sleep mode is that your key is still in memory, and can be extracted by an attacker with that expertise. Hibernation significantly reduces that risk in all scenarios. As Lucas Kauffman's answer indicates, using the advanced BitLocker implementation modes provides extra security, as well as ...


2

Bitlocker is vulnerable to much the same attack. This paper describes an attack against the PIN: "At the next boot, the MBR boot loader loads this file and transfers control to it. A fake BitLocker prompt is displayed (see figure 1); the entered PIN is stored in the NTFS partition, the original MBR is restored and the system rebooted. Later, the entered PIN ...


2

There is also the "Evil Maid" attack that could, in theory be used against any software disk encryption, as the boot loader needs to still be unencrypted. See Bruce Schneier's article about it from 2009. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html The general gist of the "Evil Maid" attack is that someone gets ahold of your laptop for ...


2

Physical access is always a very risky thing. While I don't now of any security flaws right now that will give you immediate access there are a lot of other things that you can do, eg. using a USB keylogger to intercept the user's password when he uses the machine the next time. There have been attacks using PCI cards utilizing direct memory access ...


2

After conducting extensive research on the Bitlocker platform, I believe I can answer my own question. Key reference: Bitlocker Drive Encryption Technical Overview In our default setup (at least on MS Surface Pro 3), Bitlocker, UEFI and Secure Boot are on. There is TPM 2.0 enabled. The UEFI is not password protected, and the boot order allows USB before ...


2

Thankfully no. The actual keys used to encrypt the data volume are randomly generated securely anyway. These keys are normally stored in the TPM and will be released when the TPM's integrity check is done on pre-boot components and settings. Note that the TPM key has nothing to do with the Windows user account and password (you can always add and remove ...


1

Bitlocker is a Windows Embedded Standard 7 feature included is a feature pack. For details see http://msdn.microsoft.com/en-us/library/ff794262%28v=winembedded.60%29.aspx


1

Bitlocker certainly isn't because they have law enforcement power point presentations saying they can gain access to it and you certainly don't see the Fed pressuring MS anymore like they are other groups encrypting. Stay open source and research. http://www.techarp.com/showarticle.aspx?artno=770&pgno=3


1

This is not what Bitlocker is for. Full Disk Encryption (FDE) tools like Bitlocker are only meant to protect against off-line attacks. This is where the computer's operating system is not running. Examples might be if the disk is removed and mounted in another computer, or if the computer is booted from a LiveCD or similar. When the OS is running - ...


1

If Windows is running, your drive mounted and hence unencrypted, and if your physical interfaces aren't protected against connection at the OS level, yes there are many ways to get your data out. The biggest deception point is that this access to your BitLocker protected disk will be much easier through the network than through any physical direct access. ...


1

It does sound like a flawed argument though I've not checked the details personally. But this doesn't surprise me as it seems to me, from the perspective of seeing Bitlocker deployed to a large enterprise, Bitlocker is pretty flawed anyway. Certainly TrueCrypt supports using both. Of course, the downside of using USB devices for security is their rate of ...


1

In the United States, the validation (certification) you looking for in government and some regulated areas is listed in the NIST Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules list. Per the FIPS 140-2 standard tamper based requirements start at Level 2. FIPS 140-2 Security Level 2: Security Level 2 enhances the physical security mechanisms ...


1

1) Yes, both are available. Databases can support field level, table level or full database security. They can also support externally controlled keys (provided by the client on connection to the DB) or DB managed keys (that are stored in the database and protected by the client's login credentials.) 2) Database encryption that doesn't apply to a live ...


1

This is a wild guess, but I would expect that it would depend on how you configure BitLocker when setting it up. If they allow you an option to backup the key when configuring it (which they should), then you could import that backup copy regardless of if it is exportable or not. If you don't have some backup copy of the key and it isn't exportable, I ...


1

There are two answers: No and Yes. First to the "Yes": If there is really only one known cold boot attack against bitlocker, it's extremely unrealistic that somebody executes it, and if you're not the president of the US, you're not really endangered. Second: NO! Even of it's unlikely that you're going to be attacked, it could happen! AND: You're using a ...



Only top voted, non community-wiki answers of a minimum length are eligible