Commercial tool cracks Bitlocker (Used on Win7 and Vista Enterprise) | Hacker News Reader

Commercial tool cracks Bitlocker (Used on Win7 and Vista Enterprise)

arstechnica.com

9 pointsmakmanalp9 comments

Misleading headline. All this tool does is suck the encryption keys out of the memory of a running system. Full disk encryption is only safe if attackers can't get to the running system.

From a PC Mag article on the same tool:

"The technique is impressive and useful, but not all it may seem. First, it recovers the encryption keys from a physical memory dump file which must be generated separately with other software (for instance ManTech Physical Memory Dump Utility) requiring administrator access to the system."

That said, I would be surprised if Bitlocker didn't come with NSA approved "password recovery" mechanisms.

It's one thing to have systems for the NSA, it's another thing if Microsoft's "Windows 7 Ultimate" biggest feature is easily beatable by the public. Anyone smart enough to want to steal your data is smart enough to download this program off bittorrent.

BitLocker is nothing more than another annoyance to deter lazy thieves now :\

Anyone smart enough to want to secure his data should be using TrueCrypt: http://www.truecrypt.org/

"should" yes, but it doesn't take intelligence to want to encrypt your data, just paranoia.

Microsoft is selling Windows 7 Ultimate to people who are computer illiterate with the sales pitch that it will secure their data. These people would never hear about TrueCrypt. They only hear about computer solutions with hundred-million-dollar marketing campaigns.

Some of my customers are the totally computer illiterate types who only use Microsoft products. I had been selling these people Ultimate as a way to encrypt their shit. Now I can't really recommend it as protecting against industrial espionage. And they'll never use TrueCrypt, it's too user unfriendly.

If you know what you're doing, I wouldn't be surprised if you can force a dump of the data for it from Windows, without any other tools. At the very least, if you can create a BSOD (or, I suppose if the computer has had one before), the default (at least for Windows 7 Enterprise) is to create a kernel dump.

All this shows is that its not safe to leave your computer running if you have full disk encryption. Its no different than logging into, say, Facebook at a public computer and walking away. If you're already in, it isn't that difficult to steal/change the password.

Admin access, or a working Firewire port.

Why Firewire, specifically?

The IEEE 1394 allows devices to make arbitrary DMA requests. Depending on your MMU and kernel this may allow it to read and write to the entire physical memory space including anything that may be mapped there from other devices.

Reply on news.ycombinator.com