Bad news for BitLocker users — its encryption can be cracked remarkable easily (2024)

FAQs

Can BitLocker encryption be broken? ›

BitLocker's encryption keys can be stolen with a Raspberry Pi Pico, but the exploit only works with external TPMs using the LPC bus. Most modern hardware integrates the TPM, making it more difficult to extract BitLocker keys. AMD and Intel CPUs are likely safe.

According to Microsoft sources, BitLocker does not contain an intentionally built-in backdoor, so there is no Microsoft-provided way for law enforcement to have guaranteed access to the data on a user's drive.

The Trusted Platform Module (TPM) is a hardware component that is used to secure BitLocker encryption. Verify that the TPM is enabled and properly configured in the BIOS settings.

Eavesdropping on traffic external TPM

Yet it turns out that this encryption is easy and, more importantly, cheap to crack. According to the ethical hacker, malicious parties can bypass the Bitlocker encryption by directly accessing the hardware and filtering out the encryption keys from the TPM via the LPC bus.

That is because the design of BitLocker requires a recovery key to decrypt stored data. Sometimes, users do not have their keys, which complicates the recovery. However, bypassing BitLocker's recovery key and retrieving lost data from an encrypted volume is possible.

Not 100% Secure: While BitLocker provides strong protection against most cyber threats, there are some cases where it can be bypassed by malicious actors with sophisticated techniques. As such, organizations must also consider other layers of protection when utilizing this software.

Bitlocker has no backdoors. A bare Bitlocker encrypted drive is fundamentally unhackable.

Bitlocker recovery mode can be triggered by a number of situations, including: A malicious attempt by a person or software to change the startup environment. Rootkits are one example. Moving the BitLocker-protected drive into a new computer.

For your data protection needs, Microsoft recommends that you use Microsoft Purview Information Protection and Microsoft Purview Data Loss Prevention. Note: BitLocker to Go as a feature is still supported.

With the ability to track customers' online activities, ISPs can provide governments with detailed records of websites visited, search queries, and even the time of online communications. It can provide a comprehensive overview of an individual's internet usage.

What is the downside to BitLocker? ›

Cons of BitLocker

Asking a nontechnical user to know things about encryption keys and proper storage or backup of these keys is a bit much. Not having the key can lock legitimate users out of their own data and using BitLocker can significantly impact performance (up to 45%) in some cases.

Users can decrypt a disk using the operating system (the Turn Off BitLocker function). After that, Kaspersky Endpoint Security will prompt the user to encrypt the disk again. Kaspersky Endpoint Security will be prompting to encrypt the disk unless you enable disk decryption in the policy.

Tracked as CVE-2024-38058, this important severity security flaw can let attackers bypass the BitLocker Device Encryption feature and access encrypted data with physical access to the targeted device.

Disabling BitLocker

NOTE: Decryption can take anywhere from 20 minutes to a couple of hours. The time depends on the amount of data that has been encrypted, the speed of the computer, and whether the process is interrupted.

BitLocker encryption can be defeated in seconds, and the key can be sniffed using an external TPM.

If the encryption process was interrupted then the only option may be to fully format the drive by removing the partition and starting again. Unfortunately all data will be lost.

Turn off Standard BitLocker encryption

Type and search [Manage BitLocker] in the Windows search bar①, then click [Open]②. Click [Turn off BitLocker]③ on the drive that you want to decrypt. If the drive is under locked status, you need to click [Unlock drive] and type the password to turn off BitLocker.