Tool Manual

Que : Define,explain and implement Security tool Bit locker. Ans : Bit Locker is one type of security tool. Its used for encryption and decryption of data !ic! is placed on computer !ard dri"e. Availibility of Bit Locker : Bit Locker is a"aila#le in t!e $nterprise and %ltimate editions of &indo s 'ista and &indo s (. It also is a"aila#le in )ro and $nterprise editions of &indo s *. %sers of ot!er "ersions of &indo s t!at do not include Bit Locker can use a t!ird+party encryption pro,ram to satisfy t!e need for full dri"e encryption. In t!e release of &indo s 'ista, only t!e operatin, system "olume could #e encrypted usin, t!e -%I and encryptin, ot!er "olumes re.uired usin, #ased scripts included in &indo s 'ista in t!e %Windir%\System32 folder. An example of !o to use t!e &MI interface is in t!e script manage-bde.wsf, t!at can #e used to set up and mana,e Bit Locker from t!e command line. &it! &indo s 'ista Ser"ice )ack / and &indo s Ser"er 011*, "olumes ot!er t!an t!e operatin, system "olume can #e Bit Locker+protected usin, t!e ,rap!ical 2ontrol )anel applet as ell. T!e latest "ersion of Bit Locker, included in &indo s ( and &indo s Ser"er 011* 30, adds t!e a#ility to encrypt remo"a#le dri"es. T!ese can #e read, #ut not ritten, #y &indo s 4) usin, Microsoft Bit Locker To -o 3eader pro,ram. Mechanism used in Bit Locker : T!ere are t!ree aut!entication mec!anisms t!at can #e used as #uildin, #locks to implement Bit Locker encryption: Transparent operation mode: T!is mode utili5es t!e capa#ilities of Trusted )latform Module 6T)M7 /.0 !ard are to pro"ide for a transparent user experience8t!e user po ers up and lo,s onto &indo s as normal. T!e key used for t!e disk encryption is sealed 6encrypted7 #y t!e T)M c!ip and ill only #e released to t!e 9S loader code if t!e early #oot files appear to #e unmodified. T!e pre+9S components of Bit Locker ac!ie"e t!is #y implementin, a Static 3oot of Trust Measurement8a met!odolo,y specified #y t!e Trusted 2omputin, -roup. T!is mode is "ulnera#le to a cold #oot attack, as it allo s a po ered+do n mac!ine to #e #ooted #y an attacker. User authentication mode: T!is mode re.uires t!at t!e user pro"ide some aut!entication to t!e pre+#oot en"ironment in t!e form of a pre+#oot )I:. T!is mode is "ulnera#le to a #oot kit attack.

USB Key Mode: T!e user must insert a %SB de"ice t!at contains a startup key into t!e computer to #e a#le to #oot t!e protected 9S. :ote t!at t!is mode re.uires t!at t!e BI9S on t!e protected mac!ine supports t!e readin, of %SB de"ices in t!e pre+9S en"ironment. T!is mode is also "ulnera#le to a #oot kit attack.

Recovery pass ord: A numerical key protector for reco"ery purposes Recovery key: An external key for reco"ery purposes !ertificate: Adds a certificate+#ased pu#lic key protector for reco"ery purposes "ass ord: Adds a pass ord key protector for a data "olume

#mplementation of Bit Locker : Like its official name, Bit Locker Dri"e $ncryption is a lo,ical "olume encryption system. A "olume may or may not #e an entire dri"e, and cannot span one or more p!ysical dri"es. Also, !en disa#led, T)M and Bit Locker cannot ensure t!e inte,rity of t!e trusted #oot pat! 6e.,. BI9S, #oot sector, etc.7, in order to pre"ent most offline p!ysical attacks, #oot sector mal are, etc. In order for Bit Locker to operate, t!e !ard disk re.uires at least t o :T;S+formatted "olumes: one for t!e operatin, system 6usually 2:7 and anot!er it! a minimum si5e of /11 MB from !ic! t!e operatin, system #oots. Bit Locker re.uires t!e #oot "olume to remain unencrypted8on &indo s 'ista t!is "olume must #e assi,ned a dri"e letter, !ile on &indo s ( t!at is not re.uired. %nlike pre"ious "ersions of &indo s, 'ista<s =diskpart= command+line tool includes t!e a#ility to s!rink t!e si5e of an :T;S "olume so t!at t!e system "olume for Bit Locker may #e created from already+allocated space. A tool called t!e =Bit Locker Dri"e )reparation Tool= is also a"aila#le from Microsoft t!at allo s an existin, "olume on &indo s 'ista to #e s!runk to make room for a ne #oot "olume, and for t!e necessary #ootstrappin, files to #e transferred to it> &indo s ( creates t!e secondary #oot "olume #y default, e"en if Bit Locker is not used initially. 9nce an alternate #oot partition !as #een created, t!e T)M module needs to #e initiali5ed 6assumin, t!at t!is feature is #ein, used7, after !ic! t!e re.uired disk encryption key protection mec!anisms suc! as T)M, )I:, or %SB key are confi,ured. T!e "olume is t!en encrypted as a #ack,round task, somet!in, t!at may take a considera#le amount of time it! a lar,e disk as e"ery lo,ical sector is read, encrypted, and re ritten #ack to disk. T!e keys are only protected after t!e !ole "olume !as #een encrypted, !en t!e "olume is considered secure. Bit Locker uses a lo +le"el de"ice dri"er to encrypt and decrypt all file operations, makin, interaction it! t!e encrypted "olume transparent to applications runnin, on t!e platform. T!e Microsoft $ncryptin, ;ile System 6$;S7 may #e used in con?unction it! Bit Locker to pro"ide protection once t!e operatin, system kernel is runnin,. )rotection of t!e files from processes and users it!in t!e operatin, system can only #e performed usin, encryption soft are t!at operates it!in &indo s, suc! as $;S. Bit Locker and $;S, t!erefore, offer protection a,ainst different classes of attacks. In Acti"e Directory en"ironments, Bit Locker supports optional key escro to Acti"e Directory, alt!ou,! a sc!ema update may #e re.uired for t!is to ork 6i.e. if t!e Acti"e Directory Ser"ices are !osted on a &indo s "ersion pre"ious to &indo s Ser"er 011*7.

9t!er systems similar to Bit Locker can !a"e t!eir reco"ery key@pass ord entry process spoofed #y anot!er #ootmana,er or 9S install. 9nce t!e spoofed soft are captured t!e secret, it could #e used to decrypt t!e 'olume Master Aey 6'MA7, !ic! ould t!en allo access to decrypt or modify any information on t!e user<s Bit Locker+encrypted !ard disk. By confi,urin, a T)M to protect t!e trusted #oot pat! ay, includin, t!e BI9S and #oot sector, t!is t!reat can #e remo"ed. Security !ocern usin$ Bit Locker : Accordin, to Microsoft sources, Bit Locker does not contain an intentionally #uilt+in #ackdoor> t!ere is no ay for la enforcement to !a"e a ,uaranteed passa,e to t!e data on t!e user<s dri"es t!at is pro"ided #y Microsoft. T!e lack of any #ackdoor !as #een a concern to t!e %A Bome 9ffice, !ic! tried enterin, into talks it! Microsoft to ,et one introduced, alt!ou,! Microsoft de"eloper :iels ;er,uson and ot!er Microsoft spokesmen state t!at t!ey ill not ,rant t!e is! to !a"e one added. Alt!ou,! t!e A$S encryption al,orit!m used in Bit Locker is in t!e pu#lic domain, its implementation in Bit Locker, as ell as ot!er components of t!e soft are, are closed source> !o e"er, t!e code is a"aila#le for scrutiny #y Microsoft partners and enterprises, su#?ect to a non+disclosure a,reement. T!e =Transparent operation mode= and =%ser aut!entication mode= of Bit Locker use t!e T)M !ard are to detect if t!ere are unaut!ori5ed c!an,es to t!e pre+#oot en"ironment, includin, t!e BI9S and MB3. If any unaut!ori5ed c!an,es are detected, Bit Locker re.uests a reco"ery key on a %SB de"ice. T!is crypto,rap!ic secret is used to decrypt t!e 'olume Master Aey 6'MA7 and allo t!e bootup process to continue. :e"ert!eless, in ;e#ruary 011*, a ,roup of security researc!ers pu#lis!ed details of a so+ called =cold #oot attack= t!at allo s full disk encryption systems suc! as Bit Locker to #e compromised #y #ootin, t!e mac!ine off remo"a#le media, suc! as a %SB dri"e, into anot!er operatin, system, t!en dumpin, t!e contents of pre+#oot memory. T!e attack relies on t!e fact t!at D3AM retains information for up to se"eral minutes 6or e"en lon,er if cooled7 after po er !as #een remo"ed. %se of a T)M alone does not offer any protection, as t!e keys are !eld in memory !ile &indo s is runnin,, alt!ou,! t o+factor aut!entication, i.e. usin, T)M to,et!er it! a )I:, offers #etter protection for mac!ines t!at are not po ered on !en p!ysical access to t!em is o#tained. Similar full disk encryption mec!anisms of ot!er "endors and ot!er operatin, systems, includin, Linux and Mac 9S 4, are "ulnera#le to t!e same attack. T!e aut!ors recommend t!at computers #e po ered do n !en not in p!ysical control of t!e o ner 6rat!er t!an #e left in a =sleep= state7 and t!at t!e encryption soft are #e confi,ured to re.uire a pass ord to #oot t!e mac!ine. 9nce a Bit Locker+protected mac!ine is runnin,, its keys are stored in memory !ere t!ey may #e suscepti#le to attack #y a process t!at is a#le to access p!ysical memory, for example, t!rou,! a /CDE DMA c!annel. Any crypto,rap!ic material in memory is at risk from t!is attack, !ic! t!erefore, is not specific to Bit Locker.

 %orkin$ Snapshot of Bit Locker :