5

I have a general understanding of how ransomware works. I want to know if ransomware will target a locked Bitlocker drive, however. I very rarely unlock that drive, and it will only be unlocked for backup. So, will ransomware encrypt this drive?

2 Answers 2

8

If the ransomware has full access of your operating system, nothing can stop it from encrypting your data, including BitLocker-encrypted volumes. The ransomware can simply encrypt the already-encrypted data once again, with its own key this time.

In principle, BitLocker cannot protect you from ransomware - on the contrary, it could be abused by ransomware to lock your data from yourself. It's just the matter of the way how the criminals would implement their ransomware kits. If BitLocker appeared to block some ransomware, it's just because these ransomware don't take into consideration the layer on which BitLocker works. In reality, such type of ransomware exist, for example: Petya (although it doesn't seem to be able to operate on BitLocker-enabled volumes, AFAICT).

In other words, what BitLocker did to "protect your data from being locked by ransomware" is roughly equivalent to operations like "diskpart offline volume".

Some ransomware may not simply maliciously encrypt the victim's data, they may steal (copy) those data before encrypting. After that, the criminal would be able to estimate the "value" of those stolen data. Therefore, BitLocker seems to be beneficial in such situations, in the sense that it would be a little harder for the criminal to steal the (plaintext) data.

0
5

Accurate answer varies depending on the specific ransomware and its mutations in effect.

In general though, we must assume that when it can, it will. i.e., if the ransomware code is active at the time you unlock the drive, and if it detects the new drive, it can (and will) then encrypt the contents.

Also, there is nothing stopping malware from destroying the content of locked/encrypted drives (unless it doesn't even have write access). I wouldn't bet on benign ransomware that leaves my locked drives alone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .