Researchers Crack BitLocker, FileVault

[InfoSec News <alerts () infosecnews org>]

http://www.eweek.com/c/a/Security/Researchers-Crack-BitLocker-FileVault/

By Ryan Naraine
eWEEK.com
2008-02-21 

The issue is described as a design limitation that could allow practical 
attacks against laptops in "sleep" or "hibernation" mode.

Four of the most widely used disk encryption technologiesWindows Vista's 
BitLocker, Apple's FileVault, TrueCrypt and dm-crypthave been rendered 
useless by a new attack class, according to a research paper released 
Feb. 21.

The issue is described as a design limitation that could allow practical 
attacks against laptops in "sleep" or "hibernation" mode.

Although a successful attack requires physical access to the machine, 
the research finding is significant because it means that sensitive, and 
encrypted, data stored on laptops can still be hijacked by skilled 
attackers.

"People trust encryption to protect sensitive data when their computer 
is out of their immediate control," said EFF staff technologist Seth 
Schoen, a member of the research team. "But this new class of 
vulnerabilities shows it is not a sure thing. Whether your laptop is 
stolen, or you simply lose track of it for a few minutes at airport 
security, the information inside can still be read by a clever 
attacker."

Jacob Appelbaum, a computer security consultant who participated in the 
project, said the team discovered that on most computers, even without 
power applied for several seconds, data stored in RAM seemed to remain 
when power was reapplied.

"We then wrote programs to collect the contents of memory after the 
computers were rebooted," he explained.

Stolen or misplaced laptops are the biggest target for this class of 
attack, especially when they are turned on but locked, or in a "sleep" 
or "hibernation" mode when the laptop's cover is shut.

Even though the machines require a password to unlock the screen, the 
encryption keys are already located in the RAM, which provides an 
opportunity for attackers with malicious intent, Appelbaum said.

Due to the sensitive nature of the discovery, the researchers said they 
will not release programs or source code that could assist a real-world 
attacker.

A spokesperson for Microsoft downplayed the findings, insisting that the 
claims in the research paper "are not vulnerabilities."

"[They] simply detail the fact that contents that remain in a computer's 
memory can be accessed by a determined third party if the system is 
running," Microsoft said in a statement sent to eWEEK.

"BitLocker is an effective solution to help safe guard personal and 
private data on mobile PCs and provides a number of protection options 
that meet different end-user needs," the spokesperson explained. "Like 
all full volume encryption products, BitLocker has a key-in memory when 
the system is running in order to encrypt/decrypt data, on the fly, for 
the drive/s in use. If a system is in 'sleep mode' it is, in effect, 
still running."

Microsoft suggests that the most secure method to use BitLocker is 
hibernate mode and with multi-factor authentication.

Apple officials could not be reached for comment.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn