Researchers Break into BitLocker

ZDNet UK has an interesting post about security researchers from Fraunhofer SIT that have managed to bypass the BitLocker disk encryption technology in Windows 7, Vista, and Server 2008. According to the firm, there's nothing wrong with BitLocker per se; it's just that the encryption it uses isn't foolproof, even when a hardware-based TPM (Trusted Platform Module) is present on the PC. The attack is intended to counter the widely held belief that a Trusted Platform Module (TPM) device is a foolproof way of protecting sensitive data, Fraunhofer SIT researchers said on Thursday. "Our attack demonstration does not imply a bug in BitLocker, nor does it render Trusted Computing useless," said Fraunhofer SIT researchers Jan Steffan and Jan Trukenmüller in a statement. "BitLocker still works as well as other disk-encryption products, it only fails to fulfil an unrealistic yet common expectation." "Many people seem to believe that Trusted Computing would automatically protect the system from all software-based attacks against the boot process, and in particular that using BitLocker with a TPM would achieve such protection," stated Steffan and Trukenmüller. [But] a variety of hardware-based attacks against BitLocker... remain possible. We demonstrate how an attack based solely on tampering with the boot loader may still succeed and help the attacker to gain access to confidential data." Fraunhofer SIT has published a research paper on the attack on its website. Microsoft told ZDNet UK it was aware of the attack, but could not immediately comment.