Reply to thread

Message

<blockquote data-quote="Wrecker4923" data-source="post: 1097976" data-attributes="member: 110877">I think Law Enforcements rely largely on commercial tools to overcome OS protections (like what happened with the Samsung phone of DT&#039;s assassin).&nbsp; An illustration of BL attack would be the tool provided by Cellubrite which claims to have both BL and Veracrypt attack modules.&nbsp; The BL&#039;s attack seems to be based on another company&#039;s product, Passware ( <a href="https://support.passware.com/hc/en-us/articles/360024316834-How-to-decrypt-BitLocker-using-Passware-Kit" target="_blank">https://support.passware.com/hc/en-us/articles/360024316834-How-to-decrypt-BitLocker-using-Passware-Kit</a> ).&nbsp; Passware allows key extraction from memory image and hibernation file ( I don&#039;t really know how they could get the UNENCRYPTED hibernation file, since it would be on the presumably bitlockered system volume).&nbsp; Memory image seems to be some sort of cold boot attack, necessitating moving the “fresh” memory modules and imaging them.&nbsp; Otherwise, they would have to use a brute-forcing method on the protection mechanism (like password, TPM, etc.)So, if you have a non-discrete TPM module that can&#039;t be intercepted, set up your BitLocker so that Windows will not boot without a PIN, there is probably little chance that law enforcements can break it with the easily available tools, with the system turned off.&nbsp; With the system turned on and with your keys in memory, they can probably can break both BL and VC if they can image your “fresh” memory modules.I remember there was a video of Law Enforcement seizing a newspaper&#039;s computer servers not more than a few years ago. You could clearly hear the tech saying that as long as the computer can be booted, they can routinely defeat BitLocker.&nbsp; There was also a video about the FBI grabbing hold of computers of botnet cybercriminals that were triply encrypted, which they admitted they haven&#039;t found a way to break.</blockquote>

[QUOTE="Wrecker4923, post: 1097976, member: 110877"] I think Law Enforcements rely largely on commercial tools to overcome OS protections (like what happened with the Samsung phone of DT's assassin). An illustration of BL attack would be the tool provided by Cellubrite which claims to have both BL and Veracrypt attack modules. The BL's attack seems to be based on another company's product, Passware ( [URL]https://support.passware.com/hc/en-us/articles/360024316834-How-to-decrypt-BitLocker-using-Passware-Kit[/URL] ). Passware allows key extraction from memory image and hibernation file ( I don't really know how they could get the UNENCRYPTED hibernation file, since it would be on the presumably bitlockered system volume). Memory image seems to be some sort of cold boot attack, necessitating moving the “fresh” memory modules and imaging them. Otherwise, they would have to use a brute-forcing method on the protection mechanism (like password, TPM, etc.) So, if you have a non-discrete TPM module that can't be intercepted, set up your BitLocker so that Windows will not boot without a PIN, there is probably little chance that law enforcements can break it with the easily available tools, with the system turned off. With the system turned on and with your keys in memory, they can probably can break both BL and VC if they can image your “fresh” memory modules. I remember there was a video of Law Enforcement seizing a newspaper's computer servers not more than a few years ago. You could clearly hear the tech saying that as long as the computer can be booted, they can routinely defeat BitLocker. There was also a video about the FBI grabbing hold of computers of botnet cybercriminals that were triply encrypted, which they admitted they haven't found a way to break. [/QUOTE]

Verification