Images: How to bypass FileVault, BitLocker security

by ZDNet Author | February 21, 2008 10:00am PST | Image 1 of 9

Previous | Next

Step 1: The test
A team of security researchers on Thursday reported serious vulnerabilities in disk encryption products including Microsoft's BitLocker, Apple's FileVault, and the open-source TrueCrypt. Because memory contents are not deleted when the computer is rebooted, someone can gain access to the contents of the encrypted volume by restarting it and extracting the encryption keys. Another way to extract the keys is to supercool the memory--a can of compressed air held upside-down works--and transfer the RAM to another computer where it can be read.

We decided to put their claims to the test. Because I'm an Apple user, I wanted to see if they could extract the AES encryption key from a MacBook running OS X Tiger. AES is, of course, the Advanced Encryption Standard used in innumerable security applications.

Step 1 involved creating a new password-protected account called "Breakme" with FileVault turned on and encrypted swap activated. I turned on the locking screensaver and presented Jacob Applebaum, one of the researchers on the team, with the FileVault-protected laptop. To pass the test, Applebaum needed to extract the 128-bit AES key used to encrypt the Breakme account.

Text by Declan McCullagh

Previous Next