LuciData Cracks Encrypted Laptop

Via DarkReading.com -

LuciData Inc., a leading provider of internal threat management, e-discovery and computer forensic investigative services and solutions, today announced that it has successfully cracked a laptop encrypted with Pointsec Full Disk Encryption on behalf of a corporate client.

While encryption can be a secure solution for data at rest when properly deployed, the default configuration for many companies use leaves them vulnerable to a very simple attack that effectively gives complete administrative control of the machine to anyone with physical access.

This simple attack takes advantage of the FireWire protocol and its ability to directly access and modify the RAM of a target machine with a FireWire port installed. Using a simple and readily available forensics software tool, it is possible to connect a FireWire cable to a computer, and within seconds bypass the Windows authentication and log in as a local administrator.

This attack is made possible because the operating system on the computer loads and boots directly into Windows without first asking for a Pointsec ‘preboot authentication’ password. Normally, with whole disk encryption, a user is required to enter a password immediately upon turning the machine on. That password is what unlocks the decryption key and allows the rest of the operating system to load and execute. This FireWire attack would not be successful in that case, because the attack requires that Windows already be up and running. In the circumstance of a properly configured encrypted computer, a stolen system that is powered off would be well protected from unauthorized access and this type of attack.

While the long term implications of this attack have not yet been fully investigated, the most immediate recommendation is for companies using Pointsec to redeploy its whole disk encryption solution so that preboot authentication is enabled. This would mitigate the ability to compromise computers via FireWire from a cold boot because the operating system would not load without a correct preboot password being entered.

---------------------------

This is why the government and corporate risk managers shouldn't just forget about a lost laptop that is "encrypted".

Sure, the data might be encrypted...but not all encryption products are created equally.

But someone in the DoD might want to look into this claim, given that Pointsec is a approved DoD Data at Rest (DAR) Encryption vendor.

Lets hope they are using the full disk version....

Opps!