Can BitLocker be an effective protective measure against cryptolockers and ransomware class of attacks?

Were there evidences of (un)successful intrusion/encryption attempts on volumes with enabled BitLocker? If there were not, all experts are welcome to discuss though theoretical effectiveness of such measure.

  • 2
    I think you need to review what BitLocker is – schroeder May 22 '17 at 11:00
  • Of course, I reviewed this beforehand, that's why I asked this. In my attitude, fully-encrypted volumes can be an significant obstacle for the cryptolockers, but my knowledge is insufficient to (dis)approve my assumption. – Suncatcher May 22 '17 at 11:17
  • Why would BitLocker be an obstacle for cryptolockers? From what you know, how would it protect against ransomware? – schroeder May 22 '17 at 11:19
  • From what I've read, cryptolockers (e.g. Cryakl) use the most primitive schemes of enumerating filetypes to be encrypted. While BitLocker doesn't expose directory listings, and also checks disk integrity, it can be an obstacle against this type of attacks. – Suncatcher May 22 '17 at 11:32
  • how is encrypting a file a danger to disk integrity? – schroeder May 22 '17 at 11:34

Bitlocker is very unlikely to provide protection against Cryptolocker or similar ransomware.

If the bitlocker volume is mounted on the machine which is infected, the malware can just encrypt the files inside the volume, bypassing it's protection. In the same way as a user being able to access files on a bitlocker encrypted drive, the malware can do so.

Also there's nothing, in principle, to stop ransomware encrypting files which have already been encrypted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.