Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
The important leak is how much data has been stored. It could prove, for example, that a locked drive you claimed was empty, or only contained a few documents, contained a whole bunch of stuff.
Note that FDE can indeed pass through TRIM commands to hardware. (They accept a slightly relaxed set of security guarantees to do so, but it's usually not a big deal.) Microsoft's BitLocker does this, for example. For example, you can use BitLocker on a sparsely-allocated VHD file. The NTFS driver will turn deletes into TRIMs, the BitLocker driver will pass through the TRIMs, and the VHD driver will convert the TRIMs into reclaimed sparse space.
There are CAs that will sell intermediate CA certificates, but you probably don't qualify. If you need to run your own CA, typical practice is to create your own root certificate, and distribute it yourself to the systems that you need to trust it.
Measured boot is when the TPM hashes together all the firmware and settings used when booting into its Platform Configuration Registers. It can then be instructed to seal the drive key, and only unseal it when those same values are in the PCRs. Essentially, the drive encryption key cannot be retrieved unless the same firmware and settings are loaded, so clearing the password or tampering with the boot process would make the key inaccessible.
(The best, solution, IMHO, is to throw ASP.NET under the biggest bus you can find. Of course, that may not be practical, but you should at least move to OWIN/Katana for auth.)
It's important to note that DMCA safe harbors require that a service provider adopt a policy to terminate service for subscribers and account holders who are repeat infringers in order to qualify. This policy doesn't have to be effective or practically enforceable, but it does have to exist.
You can't inject a DLL into a process more privileged than yours, so you can't use it to escalate privilege. You can use it to obfuscate your actions and deny the user an obvious target to kill in the Task Manager, but that's about it.
@FirstNameLastName All major OSes have a similar feature. Even if they didn't, you could always attach a debugger and inject the code manually. Or load a kernel module and modify the process directly. It's not a security vulnerability.
