Yet another #BitLocker "exploit" circulating.

[harrysintonen@infosec.exchange]

Yet another #BitLocker "exploit" circulating.

This is a friendly reminder that if you set your system to just unlock with TPM alone, the system is not protected against determined attacker. BitLocker with TPM cannot protect your system unless if you configure the system to request PIN as well.

See: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures

#infosec #cybersecurity

[gabrielesvelto@mas.to]

@harrysintonen if you need a pre-boot PIN to make BitLocker work, wouldn't using hardware full disk encryption just be a better option? If I have to input a password or PIN at boot I'd rather use what the hardware already provides rather than Microsoft's implementation.

[harrysintonen@infosec.exchange]

@gabrielesvelto Any solution that unlocks the encryption automatically without user having to provide "something you know" (*) is vulnerable to attacks by definition.

*) "something you have" may be good enough, for example some token or USB key. In this case you need to accept the risk of the attacker gaining access to the token, however.