Researchers Crack BitLocker, FileVault

Four of the most widely used disk encryption technologies-Windows Vista’s BitLocker, Apple’s FileVault, TrueCrypt and dm-crypt-have been rendered useless by a new attack class, according to a research paper released Feb. 21.
The issue is described as a design limitation that could allow practical attacks against laptops in “sleep” or “hibernation” mode.
Although a successful attack requires physical access to the machine, the research finding is significant because it means that sensitive, and encrypted, data stored on laptops can still be hijacked by skilled attackers.
“People trust encryption to protect sensitive data when their computer is out of their immediate control,” said EFF staff technologist Seth Schoen, a member of the research team. “But this new class of vulnerabilities shows it is not a sure thing. Whether your laptop is stolen, or you simply lose track of it for a few minutes at airport security, the information inside can still be read by a clever attacker.”
Jacob Appelbaum, a computer security consultant who participated in the project, said the team discovered that on most computers, even without power applied for several seconds, data stored in RAM seemed to remain when power was reapplied.
“We then wrote programs to collect the contents of memory after the computers were rebooted,” he explained.
Stolen or misplaced laptops are the biggest target for this class of attack, especially when they are turned on but locked, or in a “sleep” or “hibernation” mode when the laptop’s cover is shut.
Even though the machines require a password to unlock the screen, the encryption keys are already located in the RAM, which provides an opportunity for attackers with malicious intent, Appelbaum said.
Due to the sensitive nature of the discovery, the researchers said they will not release programs or source code that could assist a real-world attacker.
A spokesperson for Microsoft downplayed the findings, insisting that the claims in the research paper “are not vulnerabilities.”
“[They] simply detail the fact that contents that remain in a computer’s memory can be accessed by a determined third party if the system is running,” Microsoft said in a statement sent to eWEEK.
“BitLocker is an effective solution to help safe guard personal and private data on mobile PCs and provides a number of protection options that meet different end-user needs,” the spokesperson explained. “Like all full volume encryption products, BitLocker has a key-in memory when the system is running in order to encrypt/decrypt data, on the fly, for the drive/s in use. If a system is in ‘sleep mode’ it is, in effect, still running.”
Microsoft suggests that the most secure method to use BitLocker is hibernate mode and with multi-factor authentication.
Apple officials could not be reached for comment.