5

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data?

Few thing I noted are:

  • If someone tried to boot from external USB after restart, he will fail as he will be asked to enter bitlocker password after a restart

  • Since I am in locked screen right now and has done the booting part earlier, currently my disk is unlocked

  • It is not possible to brute force because of limit in password attempts in locked screen

  • Lets ignore the case there is already a malware in my PC or someone has already replaced sticky keys by command prompt

So is my data safe if my laptop got stolen while in locked screen?

1
  • 2
    I think you mean "brute force" rather than "DDOS".
    – Polynomial
    Commented Mar 19, 2015 at 16:29

3 Answers 3

5

No, it's not secure.

You're vulnerable to:

  • Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data)
  • DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc.
  • Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware.

In general, if an attacker has physical access to your device, you're screwed.

11
  • 1
    An average thief doesn't know cold boot or DMA attacks. And I don't have anything important enough to be useful for a professional hacker. So I think I am safe enough. Anyway thanks for answer
    – user32902
    Commented Mar 19, 2015 at 20:09
  • 2
    @VarunAgw the question as usual is who are you defending against. If it's a random thief with no intention to go after your data then yeah you're safe and with decent probability would be even if you didn't bitlocker the drive. If it's anyone willing to invest about 600$ and a couple hours of work into the project, then no you're not safe see for example elcomsoft.com/efdd.html. for some ideas.
    – DRF
    Commented Mar 20, 2015 at 7:59
  • The first and third points don't require the PC to be on and locked and are therefore invalid with regards to the question asked.
    – wensveen
    Commented Jan 7, 2021 at 15:10
  • @MaksimShamihulau DMA attacks are absolutely not prevented by BitLocker. Windows has features such as Kernel DMA Protection, Credential Guard, and Virtualisation Based Security / Core Isolation, which can help somewhat here, but they need to be enabled manually. The Kernel DMA Protection feature is the most critical one, since it prevents DMA operations on connected devices until a user logs in.
    – Polynomial
    Commented Feb 19, 2021 at 14:36
  • First off, don't leave unattended your pc and on leave turn off or hibernate to make sure RAM is nulled to prevent Cold Boot and DMA attacks. a) To prevent Cold Boot attack, use Bitlocker with TPM Only. 2) To prevent DMA attacks, use Bitlocker with TPM + PIN. So, to cover both types of attacks use Bitlocker with TPM + PIN and hibernate/turn off pc. Commented Feb 19, 2021 at 14:38
1

In addition to Polynomial's answer it's worth noting that the network interfaces will still be up and active and any access through that route (shares, remote management services etc.) may permit access to stored data regardless of screen locking. Either remote network sessions, or someone plugging in a device to your network ports could provide a surprising level of access.

0

It's a good and secure setup, but as Polynomial writes, you're still vulnerable to cold boot attacks and dma attacks. I think bitlocker lets you do some configurations in msgedit.msc that locks all ports when the screen is locked. Also, you can secure yourself from cold boot attacks by using a Ryzen Pro og Intel vPro processor that lets you enable memory encryption.

You must log in to answer this question.