3

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data?

Few thing I noted are:

  • If someone tried to boot from external USB after restart, he will fail as he will be asked to enter bitlocker password after a restart

  • Since I am in locked screen right now and has done the booting part earlier, currently my disk is unlocked

  • It is not possible to brute force because of limit in password attempts in locked screen

  • Lets ignore the case there is already a malware in my PC or someone has already replaced sticky keys by command prompt

So is my data safe if my laptop got stolen while in locked screen?

  • 2
    I think you mean "brute force" rather than "DDOS". – Polynomial Mar 19 '15 at 16:29
  • @Polynomial Damn..You really made me laugh...My silly mistake :p – VarunAgw Mar 19 '15 at 16:31
4

No, it's not secure.

You're vulnerable to:

  • Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data)
  • DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc.
  • Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware.

In general, if an attacker has physical access to your device, you're screwed.

  • An average thief doesn't know cold boot or DMA attacks. And I don't have anything important enough to be useful for a professional hacker. So I think I am safe enough. Anyway thanks for answer – VarunAgw Mar 19 '15 at 20:09
  • 1
    @VarunAgw the question as usual is who are you defending against. If it's a random thief with no intention to go after your data then yeah you're safe and with decent probability would be even if you didn't bitlocker the drive. If it's anyone willing to invest about 600$ and a couple hours of work into the project, then no you're not safe see for example elcomsoft.com/efdd.html. for some ideas. – DRF Mar 20 '15 at 7:59
2

In addition to Polynomial's answer it's worth noting that the network interfaces will still be up and active and any access through that route (shares, remote management services etc.) may permit access to stored data regardless of screen locking. Either remote network sessions, or someone plugging in a device to your network ports could provide a surprising level of access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.