Bitlocker Security Questions

hdmi said:

As a matter of true fact, it's right here in this very thread. Buried underneath a dozen pages of mostly internet noise complete with regurgitations of what Microsoft has claimed despite that took 43 seconds to refute with evidence. lmao

Click to expand...

What you say is true. Nothing is 100% guaranteed safe and 100% foolproof. However, I believe that the possibility of that particular hack happening to me is small enough that it doesn't worry me. I've used BitLocker for a couple of decades, and I still have confidence to continue using it. As always, YMMV.

That Razer privileges exploit has been patched. And it would not work when the computer was locked! Or am I mistaken?

"Buried underneath a dozen pages of mostly internet noise complete with regurgitations of what Microsoft has claimed despite that took 43 seconds to refute with evidence"

I find this quite insulting to me and fellow members!

The reality is that translating "likelihood as minuscule as possible to achieve by Microsoft" to "100% likelihood" took 43 seconds, and took 43 seconds regardless of what makes you or anyone else feel the most comfortable. Data security is not capable of having any feelings.

@TraderGary

When your laptop is locked, is wifi still active? I know my Windows Updates sometimes occur in the middle of the night when the lid is closed.

kelper said:

@TraderGary

When your laptop is locked, is wifi still active? I know my Windows Updates sometimes occur in the middle of the night when the lid is closed.

Click to expand...

I use Modern Standby, so the answer would be yes.

kelper said:

That Razer privileges exploit has been patched. And it would not work when the computer was locked! Or am I mistaken?

Click to expand...

I think they added it to the vulnerable drivers blocklist a long time ago, and I don't know if it worked when the computer was locked. But that USB cable that I was referring to certainly did work when the computer was locked (and I don't know if it currently still does) unless you had disabled the USB ports. Disabling the ports may be possible to achieve in BIOS, but BIOS password protection mechanisms oftentimes turned out to be easily bypassed despite manufacturer's persistent claims to the contrary. Even if it's possible to fix the vulnerabilities, the fact still remains that not everyone knows how. Hackers LOVE old mantras from the likes of "don't patch your BIOS when you don't need to" and "don't try to fix it if it ain't broke". As for BYOVD and the familiar subject of "feeling comfortable". This article wasn't out yet when I pointed out more than 2 years ago that feelings can easily be misguided. Forget vulnerable drivers - Admin is all you need — Elastic Security Labs
So no. It's not about being insulting. Rather, it's just me being able to predict the future!

I love this thread. It's like a Mobius strip.

barreleye said:

I love this thread. It's like a Mobius strip.

Click to expand...

So there seems to be mixed opinions then. So if you have your laptop out in the open and someone can do something to your laptop for a minute like plug in a USB flash drive but your laptop is locked to the windows screen, can they put malware or keylogger in it or not?


TraderGary, the issue is sometimes you could mistakenly click on a link by mistake whether by email or whatever it maybe.


So like say you are in a hotel room to make it simple. You leave your laptop in your hotel room when go are visiting whichever city you are at. Most people are not going to be bringing their laptop with them. But if someone got access to their laptop and want to put malware on it, it would be easy if their laptop had no bitlocker and everything is open. But if it has bitlocker, it is a lot harder. It would be hard if laptop is window locked as well but not as hard. So can someone put malware on your laptop when the laptop is locked? I leave my laptop on but locked all the time if I"m not using it. Now if I power it off, then you would need the bitlocker pin so that would be another step. But I don't want to deal with that. What about the BIOS password? I don't have that activated. So that is necessary then if someone gets access to your laptop and just needs your windows password... they could just shut down your laptop and go to BIOS setting and then put malware on it? But do they have to enter the bitlocker pin first? I don't believe so right?

Can anyone here confirm that your laptop is safe as long as it's either turned off which would require someone to enter you bitlocker pin and windows 11 password to get in? Or if it's locked, that person still needs your windows 11 pro password to get in? This is assuming your BIOS does not have a password. Or you have to have a BIOS password in order to be protected here?

Yes, you need a BIOS password other wise someone change boot it from a USB.

Can others here confirm the BIOS password is needed for security of the laptop? How come none of this is mentioned with bitlocker? I thought as long as you have a bitlocker pin, then it was good enough? Having the windows 11 password would be the 2nd form of security. But none is mentioned about the BIOS password?


How easy is it to set this up? So you turn on laptop and press F something repeatedly and then do what? Then you type in password and enter and that is all?


So if someone has access to your laptop, they need to know your BIOS password in order to get in. But if you don't have BIOS password, someone could use a USB flash drive and change boot... can you explain the change boot process? So they can access your computer files or you mean something else? Does that mean someone who uses a USB flash drive can do that or if they do that, they still need you to enter your bitlocker pin and windows password and only then they have access to your laptop if they somehow get access to it a 2nd time? I assume my last statement is completely wrong here but confused with the USB and the change boot. The thing is I can't imagine most people who use bitlocker have the BIOS password on or even know about this?

newmann said:

Can others here confirm the BIOS password is needed for security of the laptop? How come none of this is mentioned with bitlocker? I thought as long as you have a bitlocker pin, then it was good enough? Having the windows 11 password would be the 2nd form of security. But none is mentioned about the BIOS password?


How easy is it to set this up? So you turn on laptop and press F something repeatedly and then do what? Then you type in password and enter and that is all?


So if someone has access to your laptop, they need to know your BIOS password in order to get in. But if you don't have BIOS password, someone could use a USB flash drive and change boot... can you explain the change boot process? So they can access your computer files or you mean something else? Does that mean someone who uses a USB flash drive can do that or if they do that, they still need you to enter your bitlocker pin and windows password and only then they have access to your laptop if they somehow get access to it a 2nd time? I assume my last statement is completely wrong here but confused with the USB and the change boot. The thing is I can't imagine most people who use bitlocker have the BIOS password on or even know about this?

Click to expand...

you set up the BIOS password in the security section of the BIOS.
this BIOS password is only used when trying to enter the BIOS and at no other time
or if any device such as a USB drive requires access.
so its important that this BIOS password is something you can remember easily.

best of luck, Steve ..
edit to update BIOS access.

Like I already said earlier in the thread, in many cases the BIOS password protection can be bypassed anyway. If an attacker has physical access to the hardware, most BIOS password protection mechanisms are kind of like being able to drill through the lock of a door while leaving the drill standing on the doorstep and leaving it plugged in to the extension cord so as to make it easier/faster for an attacker to get in.

But changing the boot parameters such as disabling Secure Boot and/or changing the boot order will trigger BitLocker's recovery mode if BitLocker is set to use the TPM. It uses the TPM's PCR7 and PCR11 registers for that. While it is true that BitLocker with TPM+PIN protects the PIN (with anti-hammering and due to the fact that the PIN authentication is part of the BitLocker authentication mechanism itself), multiple ways have been proven to exist that make it possible (and easy...) for an attacker to steal the BitLocker key from memory.

One of these ways is to plug in a so-called O.M.G. cable (that I referred to earlier in the thread) to gain access to the memory when the BitLocker key has not been cleared from the memory. Various security fixes may have been made available to address these vulnerabilities. But the assumption that everyone knows how to get these fixes and apply them correctly is wrong.

The assumption that setting up a BIOS password will always prevent an attacker from being able to turn USB ports back on after you have disabled them in the BIOS is also wrong. You'd probably want to look at other strategies to keep the USB ports disabled securely. It's one of those reasons why security hardening a laptop tends to be no easy task, and why security companies exist that offer this as a paid service (usually not cheap). That plus the fact that keeping the USB ports disabled on a laptop can be seen as a drastic sacrifice in connectivity features.

Again, I will repeat that even with the TPM+PIN method, BitLocker alone is not secure. It can be used as one of multiple different building blocks in the particular sense that one building block alone can not, will not, make a wall. Let alone make four walls and a roof........

I plan to continue using my password manager, making daily drive images, using encrypted cloud storage, and using BitLocker. As you advocate @hdmi, BitLocker is only one part of my total computer security strategy.

Just playing the devil's advocate - if a bad actor accesses my laptop and the BIOS is not password protected, could he plant some malware if Bitlocker is active? Do some people choose to encrypt each partition (apart from the EFI) or just the C: drive?

I have only a C: drive on each of my two laptops. BitLocker encrypts only the C: OS partition.

Surely you have a recovery partition?

kelper said:

Surely you have a recovery partition?

Click to expand...

Yes, but there is no reason to have it encrypted.