BlueHat v18 || An Ice Cold boot to break bitlocker

Olle Segerdahl, F-Secure
Pasi Saarinen, F-Secure

A decade ago, academic researchers demonstrated how computer memory remanence could be used to defeat popular disk encryption systems[1]. Today, most seem to believe that these attacks are too impractical for real world use. Microsoft has played down the threat of memory remanence attacks against BitLocker using words such as "they are not possible using published techniques"[2].

We will show techniques that allow recovery of BitLocker encryption keys from RAM on most, if not all, currently available laptops and tablets. These techniques allow bypassing of security controls such as password protected BIOS configuration, UEFI-based Secure Boot and the TCG Platform Reset Attack Mitigation by directly manipulating the firmware storage device (EFI SPI flash chip).

[irshadt]

How could we recover the bitlocker key in case we forgot this and been asked on boot?

[XEQUTE]

what about if you have the recovery key but you cannot the encryption?

[Threadbow]

User has no access to data Either
Bitlocker key should be easier to find.
You do no warn this happens that you lose all data.

Beyond mad at microsoft
Your not helping you are destroying lives of your users

[alessataylor]

bitlocker self activated after mobo replacement!!! I can' wipe c:// evidence on there i need for a trial..and there are no keys, anyone who can help comment, lmk NO KEYS. but there has to be auto gen s

[Threadbow]

You cannot get any help from Microsoft.
Dell don't care they set up the bit locker but don't tell you.

Spend nearly 2 thousand uk pounds on laptop to lose all yr data
I never buy or use Microsoft ever again
Nor dell.

Mac for me from now on.

Cheers microsoft, you lost all my data. But if their stole laptop they can use no problem.

My disc is blank dell think it's funny.