Click here to receive your FREE subscription to Campus Technology
News
BitLocker Password Exploit Is 'Very Unlikely,' Sisk Says
8/29/2008
|
|
Redmond responded Tuesday to an independent security vendor's discovery of a hard-drive encryption vulnerability affecting Microsoft's BitLocker function, Intel/HP's BIOS and several other products and programs.
Microsoft acknowledged the threat, which was described by representatives of Kolkata, India-based iViZ at the Defcon 16 event. Redmond offered some explanations and workarounds.
"We recognize that the claim detailed in the presentation by the researcher about BitLocker is correct," wrote Bill Sisk, security response communications manager for Microsoft, in an e-mail sent today. "This theoretical attack is only possible in targeted situations, and while probable, [it's] very unlikely."
Sisk's comments come as a retort to an announcement on Monday from iViZ, a security penetration testing company. iViZ said that it had discovered a new class of a preexisting vulnerability that allows attackers to steal computer boot passwords. The exploit bypasses the security of preboot authentication software, such as Microsoft's BitLocker hard-disk encryption tool.
The premise of iViz's argument lies in the fact that programmers who might be unaware of such bugs tend to code boot password features in a way that doesn't expunge critical information from the hard drive. It's a circumstance that could lead to "inadvertent leakage and theft," according to the company's announcement. Even the most thorough hard-drive encryption scheme may not be able to block this vulnerability.
To that end, Sisk added that the software giant has addressed such issues in Windows Vista Service Pack 1, and he encouraged "customers to update their systems accordingly."
BitLocker, first released in January 2007, is designed to guard personal and private data on mobile PCs. It comes with other protection options that can be customized to meet the needs of various end users.
"Like all full volume encryption products BitLocker has a key-in memory when the system is running in order to encrypt/decrypt data, on the fly, for the drive/s in use," wrote Sisk. "If a system is in 'Sleep mode' it is, in effect, still running."
In that vein, Microsoft encourages IT pros concerned about such bugs to consult best practices on data encryption in BitLocker, previously published by Redmond here.
Among other things, Microsoft's guidance expounds on the balance of security and usability when using BitLocker in hibernate mode.
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. You can contact Jabulani at editor@entmag.com.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Georgia Tech Helps Develop Web-based Tool To Improve Blood Supply
The Georgia Tech College of Computing, working in partnership with the Centers for Disease Control and Prevention, has developed a Web-based tool for tracking blood safety. The program is expected to help developing countries improve the adequacy and safety of their national blood supplies through better monitoring and evaluation.
- Mississippi State Implements Reflex Virtual Management Center
Mississippi State University has implemented Reflex VMC (Virtual Management Center) from Reflex Systems. The application allows IT administrators to monitor a virtual infrastructure and enforce business and IT policies.
- Stanford Law School Launches IP Litigation Clearinghouse
The Law, Science & Technology Program at Stanford Law School has launched the Intellectual Property Litigation Clearinghouse (IPLC), an online database that offers comprehensive information about intellectual property (IP) disputes within the United States.
- Texas A&M Health Science Center Adopts Banner Administrative Management
The Texas A&M Health Science Center has selected the Banner Unified Digital Campus (UDC) from Sungard Higher Education to help unify its geographically-dispersed community and to enhance and expand services and communications to its growing student enrollment.
- NCCC: Data Cleansing Key To Managing Growth
Community colleges are in a good spot in some ways during the economic downturn, as tight family budgets drive up the appeal of the community college option. But along with the rest of higher education, most community colleges also face shrinking IT budgets and tighter resources. That makes it that much harder to handle the growing enrollment numbers that some community colleges are seeing.
- Finjan: Layoffs Could Drive IT People To Become Cyber-Criminals
Security vendor Finjan predicts that the current economic downturn could herald a sharp rise in cybercrime during 2009--driven by the rise in the number of IT people being laid off. According to a report from the company's Malicious Code Research Center (MCRC), more unemployed IT personnel will be tempted to seek "new and easy income by purchasing and using crimeware toolkits that are sold by professional hackers."
