3

I have a general understanding of how ransomware works. I want to know if ransomware will target a locked Bitlocker drive, however. I very rarely unlock that drive, and it will only be unlocked for backup. So, will ransomware encrypt this drive?

3

Accurate answer varies depending on the specific ransomware and its mutations in effect.

In general though, we must assume that when it can, it will. i.e., if the ransomware code is active at the time you unlock the drive, and if it detects the new drive, it can (and will) then encrypt the contents.

Oh BTW, there is nothing stopping malware from destroying the content of locked/encrypted drives (unless it doesn't even have write access). I wouldn't bet on benign ransomware that leaves my locked drives alone.

2

If the ransomware has full access of your operating system, nothing can stop it from encrypting your data, including BitLocker-encrypted volumes - the ransomware can simply encrypt the already-encrypted data once again, with its own key this time.

In principle, BitLocker cannot protect you from ransomware - on the contrary, it could be abused by ransomware to lock your data from yourself. It's just the matter of how the criminals would implement their ransomware kits. If BitLocker appeared to block some ransomwares, it's just because these ransomwares didn't take considerations in the layer which BitLocker works at - in reality, such type of ransomwares indeedly exist, for example: Petya (although it doesn't seem to be able to operate on BitLocker-enabled volumes, AFAICT).

In other words, what BitLocker did to "protect your data from being locked by ransomware" is roughly equivalent to operations like "diskpart offline volume".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.