14 DAY TRIAL // UPDATE: Here are the instructions on how to temporary resolve the bug in Windows 10 by switching from hardware encryption to software encryption in BitLocker. Original story below.
A major security vulnerability in the hardware encryption system of several Solid State Drives (SSDs) leads to additional problems for Windows users, breaking down the BitLocker feature bundled into the operating system.
The security flaw was discovered by Dutch security researchers Carlo Meijer and Bernard von Gastel from Radboud University and describe a method that relies on firmware reverse-engineering to access data without an encryption key.
The research paper shows that in some cases, drives can be accessed without any password, while in others, the only thing a potential hacker would need is to send an empty string as a password in order to decrypt the drive and access the stored data.
According to their findings, the flaw exists in several SSDs, including Crucial MX100, MX200 and MX300, as well as Samsung's T3 and T5, 840 EVO and 850 EV internal SATA SSDs.
Microsoft’s BitLocker broken down
To make the matter worse, Microsoft’s BitLocker, which is available for all Windows users, appears to be rendered useless by the vulnerability.
And it’s all because, by default, BitLocker uses hardware encryption for SSD drives. If it’s not available, then the feature switches to software encryption to protect the data on the drive.
Microsoft has already acknowledged the bug and said that it exists on all Windows versions where BitLocker is offered, including Windows 10.
“Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives (SEDs). Customers concerned about this issue should consider using the software only encryption provided by BitLocker Drive Encryption. On Windows computers with self-encrypting drives, BitLocker Drive Encryption™ manages encryption and will use hardware encryption by default,” the company says.
Users are recommended to switch from hardware encryption to software encryption if they use one of the affected SSDs. The temporary mitigation can be implemented from the Group Policy on the impacted Windows versions.