0

Can a drive (system or external) that is already Bitlocker encrypted and locked, be able to be attacked and encrypted by ransomware? We need prevention from over-encryption, not destruction or formatting.

This question has been asked, but it is not clear whether the answers there are applicable for drives that are locked after BitLocker encryption.

We have tried to encrypt a drive in a locked state (via BitLocker) with Veracrypt, but it is giving a message that it will be able to encrypt only after formatting the drive as it is not NTFS drive. So can we conclude drives in a locked state are safe from ransomware encryption?

1
  • 3
    "I couldn't do it, therefore it's impossible" is a dangerous conclusion to make. Starting by assuming malware can do something malicious, until you have a specific measure in place to counter that is a much better approach. Nothing really stops ransomware, with access to an encrypted drive, to encrypt it again.
    – MechMK1
    Oct 4 '21 at 11:38
1

Bitlocker (and other FDE schemes) protects against one thing, and only one thing:

Access to data at rest.

Once the operating system is running, and the drive is mounted, it's not protected against access. The normal OS ACL's apply at that point.

When not mounted, it protects against access to data. It does not protect the ciphertext from modification (albeit it may protect against meaningful modification, dependent on algorithms), and it doesn't protect the ciphertext from erasure or corruption.

3
  • I think the OPs emphasis on "locked" means that it is not mounted. Maybe that was an edit to the original question though.
    – hft
    Oct 4 '21 at 18:45
  • That doesn't really change anything. The principle is that FDE protects data at rest.
    – vidarlo
    Oct 4 '21 at 19:43
  • Yes, you're right, that's all true. I'm just saying that it looks like only the last paragraph of your answer is directly addressing the question (the paragraph starting "When not mounted...").
    – hft
    Oct 4 '21 at 20:23
1

Can a drive (system or external) that is already Bitlocker encrypted and locked, be able to be attacked and encrypted by ransomware?

In this case, ransomware that operates at the logical file system level would not be able to access the drive, but neither would any useful application software. The drive would just be inaccessible via the usual logical file system methods. In other words the drive would be pretty useless.

But you are still not safe from ransomware. Certainly, one could create ransomware that operates at the block level and thereby can encrypt an already encrypted (and "locked") drive without mounting it. In this case, the Bitlocker encrypted data could be re-encrypted at the block level by ransomware. (But, N.B., this is not how most ransomware typically works).

1
  • 1
    If I understand BitLocker correctly, ransomware would only have to encrypt the block(s) containing the full volume encryption key. The volume master key might be stored somewhere the ransomware can't get at, but AIUI without the full volume key that's useless. Oct 5 '21 at 4:31
0

We have tried to encrypt a drive in a locked state (via BitLocker) with Veracrypt, but it is giving a message that it will be able to encrypt only after formatting the drive as it is not NTFS drive.

This means that VeraCrypt does not recognize the format of the drive, so it won't encrypt it, because it doesn't know what it is doing. That does not that VeraCrypt is physically incapable of reading the cyphertext from that drive and replacing it with something else.

However, it would be perfectly possible to reformat the drive as NTFS using your favorit disk format tool, thereby losing all the (encrypted) data. If your favorite disk format tool can do that, then so can ransomeware. At least in theory. In practice, most ransomware will use the the regular filesystem API, and won't know what else to do if that fails. But creating a ransomware which accesses volumes on the binary level (thereby bypassing the filesystem) would be perfectly possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.