The BitLocker feature of Windows is supposed to offer a degree of peace of mind that files are going to be secure -- but one expert points out that a simple key combo is all it takes to bypass the security feature.

A bug has been discovered in the way Windows 10 handles a Feature Update -- the installation of a new build of the operating system. By taking advantage of the bug, it is possible to access a Command Prompt and gain unrestricted access to the contents of the hard drive.

The reason for this is that BitLocker is disabled during the update process, as security expert Sami Laiho points out. He reveals that exploiting the bug takes nothing more than pressing Shift + F10 during the upgrade and you can then access the Command Prompt in the Windows PE (Preinstallation Environment) used during the upgrade.

While exploiting the bug -- which, we are assured, Microsoft is 'working on' -- does require access to a computer, it is still a concern. Laiho says:

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube. Open source tool leverages graphics processing to decrypt BitLocker-protected units. Researchers have outlined their progress in further developing BitCracker, a GPU-powered password-cracking tool built specifically to break BitLocker, the full disk encryption built into Microsoft Windows.

The real issue here is the Elevation of Privilege that takes a non-admin to SYSTEM (the root of Windows) even on a BitLocker (Microsoft's hard disk encryption) protected machine. And of course that this doesn't require any external hardware or additional software.

So what can you do to keep your computer secure? Well, until a fix is released for the problem, there are limits to the protective steps you can take, but Laiho offers the following advice:

Don't allow unattended upgrades
Keep very tight watch on the Insiders
Stick to LTSB version of Windows 10 for now

Photo Credit:Anton Watman / Shutterstock.com

How To Crack Bitlocker Password In Kali Linux

As explained in “Should you pull the plug?” and “BitLocker Forensics” you should always capture the RAM of a live system. If there is a BitLocker volume mounted there is a good chance you will be able to extract the key from the memory. In this post, I will explain how to extract the key from a RAM dump using Passware Recovery Kit Forensic.

In BitLocker Forensics I explained how you can export the recovery key on a live system. But there are times where you might not be able to export the key (e.g. the system is locked down in some way) but you are able to capture the ram. The RAM capture contains a lot of information, including the BitLocker keys. There quite a few tools on the market that are able to extract the key from a RAM capture. In this post, I will be using Passware Recovery Kit Forensic. It’s an affordable sub $1000 solution and it’s easy to use. As a disclaimer, let me state that I am not affiliated with Passware and their products in any way.

In the main screen of PRKF there are several recovery options, in order to extract the key from a memory dump we need to choose “Full Disk Encryption“.

PRKF supports several popular encryption methods. This includes:

BitLocker
TrueCrypt
VeraCrypt
PGP Whole Disk Encryption
FileVault
Apple Disk Utility Encryption
LUKS

How to crack bitlocker password in pendrive

The one we are interested in is BitLocker, so we select the “BitLocker” option.

In the next window, we need to select a few things. First, we need to select the BitLocker volume image file. This should be the image of the encrypted disk, in this example, I am using an encrypted VHD (Virtual Hard Disk) file. Secondly, we need to choose our memory image. It’s possible the extension isn’t recognized by default, you might want to select “All Files (*.*)” when browsing for the image file.

Note the bottom option for a Brute-force attack. Even when you are using a high-end system this attack will be too slow to be a viable way to attack a good BitLocker password. When you click “Next” the attack will start.

On my system, using an i7-6700K and a GTX 1060 the attack will take just under 2 minutes to complete. Please note that both AMD and NVIDIA cards are supported for GPU acceleration. I highly recommend getting high-end NVIDIA cards if you need to crack passwords on regular basis.

After 1 minute and 43 seconds, the attack has completed and the key is revealed. This key can now be used to access the BitLocker volume.

How To Crack Bitlocker Password In Pendrive

Please note that the amount of time needed for extracting the key depends on the size of the volume, the size of the ram capture and the hardware of the machine running PRKF.