Cybersecurity

5930 readers

404 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

[email protected]

190

Windows 11 BitLocker Bypassed to Extract Encryption Keys (gbhackers.com)

submitted 5 days ago by [email protected] to c/[email protected]

25 comments fedilink hide all child comments

An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption.

The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 9 points 5 days ago* (last edited 5 days ago) (2 children)

What's the advantage of disk encryption if you don't require a password to boot? Couldn't you just boot the device and extract the data using Explorer anyway?

[–] [email protected] 11 points 5 days ago

Its kinda useful for devices where userland is also protected against exfil, like a kiosk or windows lock screen.

If the bios is hardened, secure boot on, bitlocker on, and windows is locked with a password, you can't simply take the disk out and manipulate it cause bitlocker with TPM means only that specific hardware profile will decrypt the disk automatically.

You can't get to explorer cause the system is locked with windows auth, and you can't reset the PW cause bitlocker is on, and you cant remove the disk cause the TPM protects against that with bitlocker.

Its really not perfect, and I'm not advocating for it, but its a decent protection in systems where adding another pin/password isn't practical.

Even Microsoft recommends at least also using a pin with bitlocker.

[–] Limonene 4 points 5 days ago (1 children)

I assume they think the Windows login password will keep them safe. I don't know. But many corporate computers (several I've been forced to use) do use Bitlocker without a password.

[–] [email protected] 2 points 4 days ago

Yeah, that's only going to protect from drive theft, which I guess makes disposal easier?