4 ms·
> a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE) I always wondered why the recovery en
by londons_explore 3y ago
> a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE)
I always wondered why the recovery environment seemed to let me have SYSTEM privileges to my auto-decrypted system drive... Thats been the case for years, and you can use it to dump the contents of a machine you've lost the login password to for example.
I guess it wasn't supposed to!
- smileybarry 3y agoIIRC WinRE asks for a local administrator password before doing any recovery operations, no? Also, this is one of the reasons why "auto unlock" is generally a huge asterisk and PIN/password/network unlock are recommended instead, if possible. (Though they do force you to be a laptop nanny during update times and unlock it on every restart...)
- londons_explore 3y ago> WinRE asks for a local administrator password before doing any recovery operations, no? Not for the "Shift+F10" command prompt option....
- smileybarry 3y agoAre you sure the system drive you see is the real drive and not just the bootable WinRE partition? You technically have two "?:\Windows" roots in that state, one of WinRE that just booted and one of the system you're restoring.
- briHass 3y agoOnly if you don't use a TPM PIN and/or have a <2.0 TPM. Bitlocker using TPM with PIN has no way to know your hard drive key without asking the TPM, which requires the PIN (and has anti-hammering/lockout built in.)