There is currently a patch available for full disk encryption feature, BitLocker. Security researchers have identified a major vulnerability within the unpatched version that puts machines that should be encrypted and use this product at risk. The vulnerability stems from the relationship BitLocker has with computers on a domain, which can be found in almost any corporate wide area network (WAN).
The security gap is the result of the encryption product checking a user’s password against information stored on the domain controller. With this being the case, it is possible to remove the encrypted laptop from the WAN, create a sandbox local area network (LAN), and convince the computer that it is checking a user’s legitimate credentials against a falsified machine that is acting as a domain controller.
All machines running this previous version of BitLocker should be patched immediately following discovery of this logic flaw. Microsoft fixed the vulnerability Tuesday and published the corresponding MS15-122 security bulletin.
If you have any questions regrading this patch please contact a certified GraVoc employee
Related articles
GraVoc Recognized on CRN MSP 500 List for Second Year in a Row
For the second year in a row, GraVoc has been recognized on the CRN® MSP 500 list in the Pioneer 250 category!
PCI SAQ Types: Which SAQ is Right for Your Business?
In this blog post, we provide an overview of the SAQ types for PCI DSS v4.0 and how to select a PCI SAQ that’s right for your business.
GraVoc Wins Banker & Tradesman’s Best of 2023 Awards
GraVoc won a Silver Medal for Cybersecurity and a Bronze Medal for Web Design in Banker & Tradesman’s Best of 2023 readers’ choice awards!