You might have read about a possible BitLocker security hole that would allow a malicious user access to information secured on a BitLocker encrypted volume. If not, check out this story:
http://www.securityfocus.com/brief/686
The problem with this supposed security hole is that the following assumptions must be made about the system being protected by BitLocker:
- The user hasn’t configured a log on PIN for BitLocker
- The user hasn’t configured a USB key to be used to with BitLocker log in
- The user hasn’t configured both a USB and a PIN to be used with BitLocker log in (this is supported by Windows Server 2008 and Vista SP1)
- The attacker has physical access to the machine (obviously)
- The user’s computer is in Sleep mode, not in Hibernation mode
- The attacker has a laptop, compressed air, and special tools on hand to quickly access the information contain in RAM
That is a lot of assumptions, which makes it unlikely that the attack would actually be implementable in the real world extremely unlikely. However, there is always the risk of a specifically targeted attack, where the attacker knows the victim with the computer he wants to steal, and carefully sets up the scenario in advance so that all the conditions required to compromise the BitLocker protected volume are in place. In such a targeted attack, it’s more likely that the BitLocker exploit can be executed.
However, you as a network admin have the power to completely foil such an attack. How? By configuring Group Policy in a way that forces users to use log on authentication in the form of PIN or USB key. In addition, you can configure Group Policy or use scripts to insure that Sleep Mode is disabled and that users always enter Hibernation Mode when they close the computer.
Using these simple methods, you completely obviate the risk of the exploit described for retrieving key material from RAM and make it impossible for them to use this exploit to compromise BitLocker protected volumes.
For more information about best practices for protecting BitLocker encrypted volumes and managing fleets of BitLocker enabled computer, check out the Microsoft Data Encryption Toolkit at:
HTH,
Tom
Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
GET THE NEW BOOK! Go to http://tinyurl.com/2gpoo8
Email: [email protected]
MVP – Microsoft Firewalls (ISA)