Sign In
Michael Howard's Web Log
A Simple Software Security Guy at Microsoft!
Translate This Page
Translate this page
Powered by
Microsoft® Translator
Options
Blog Home
Email Blog Author
Share this
RSS for posts
Atom
RSS for comments
Search
Advanced search options...
Search In:
Everything
Blogs
Forums
People
Groups
Places
Pages
Date range:
All Time
Last Year
Last 6 Months
Last 3 Months
Last Month
Last Week
Last Two Days
Tags
General
Pages
Personal
Privacy
Rant
Security
Vista
Archive
Archives
September 2009
(1)
July 2009
(1)
May 2009
(2)
March 2009
(1)
December 2008
(2)
November 2008
(3)
October 2008
(3)
September 2008
(7)
August 2008
(5)
July 2008
(3)
June 2008
(1)
May 2008
(1)
April 2008
(5)
March 2008
(5)
February 2008
(4)
January 2008
(9)
December 2007
(4)
November 2007
(4)
October 2007
(6)
September 2007
(1)
August 2007
(2)
July 2007
(4)
June 2007
(13)
May 2007
(6)
April 2007
(8)
March 2007
(11)
February 2007
(4)
January 2007
(8)
December 2006
(4)
November 2006
(15)
October 2006
(5)
September 2006
(6)
August 2006
(6)
July 2006
(2)
June 2006
(7)
May 2006
(8)
April 2006
(2)
March 2006
(5)
February 2006
(6)
January 2006
(10)
December 2005
(2)
November 2005
(2)
October 2005
(1)
September 2005
(4)
August 2005
(5)
July 2005
(5)
June 2005
(3)
May 2005
(9)
April 2005
(8)
March 2005
(5)
February 2005
(9)
January 2005
(7)
December 2004
(7)
November 2004
(9)
October 2004
(11)
August 2004
(13)
July 2004
(4)
June 2004
(12)
May 2004
(17)
April 2004
(2)
March 2004
(2)
February 2004
(3)
January 2004
(2)
A Real-world Windows Vista BitLocker Tip
MSDN Blogs
>
Michael Howard's Web Log
>
A Real-world Windows Vista BitLocker Tip
A Real-world Windows Vista BitLocker Tip
Rate This
Michael Howard
24 Mar 2007 11:51 AM
Comments
13
Like a good Microsoft security citizen I installed BitLocker on my Infineon TPM-enabled laptop ages ago, well before we shipped the OS in late 2006. The nice thing is that I don't even know BitLocker is ‘doing its thing’ as there is no performance degradation that I can see.
But there is something you ought to be aware of.
If, like me, you use Sleep mode (aka Standby) on your laptop then it is possible that an attacker can logon to the laptop because Standby simply puts the machine into a very low power state (i.e. memory is still hot) and simply prompts me to re-enter my logon creds. Of course, if the attacker can break your password or smartcard PIN (and has access to the smartcard), then you have a whole swag of other problems to worry about! But humor me for a moment. So what I do, mainly when I’m traveling, in a hotel room or at conferences, is put the machine into Hibernate mode; the mode that writes RAM contents to disk and I have implemented BitLocker so the it requires me to enter a pre-boot PIN.
Now, when the laptop lid is opened, the attacker (or me) is prompted for the BitLocker PIN to load the image off disk. They could try to guess the PIN but the TPM is used to unlock the disk and has anti-hammer technology built into it. After every
n
failed attempts the TPM goes to sleep for
x
seconds - and
x
increases exponentially. The BitLocker
recovery model
works fine without the PIN should I forget it in my old age!
Sure, Hibernate is a little slower than Sleep, but it does have the advantage of requiring no power, and it could help protect your ass(ets) when you use BitLocker.
13 Comments
Security
,
Vista
Blog - Comment List MSDN TechNet
Comments
Loading...