There is currently a patch available for full disk encryption feature, BitLocker. Security researchers have identified a major vulnerability within the unpatched version that puts machines that should be encrypted and use this product at risk. The vulnerability stems from the relationship BitLocker has with computers on a domain, which can be found in almost any corporate wide area network (WAN).
The security gap is the result of the encryption product checking a user’s password against information stored on the domain controller. With this being the case, it is possible to remove the encrypted laptop from the WAN, create a sandbox local area network (LAN), and convince the computer that it is checking a user’s legitimate credentials against a falsified machine that is acting as a domain controller.
All machines running this previous version of BitLocker should be patched immediately following discovery of this logic flaw. Microsoft fixed the vulnerability Tuesday and published the corresponding MS15-122 security bulletin.
If you have any questions regrading this patch please contact a certified GraVoc employee
Related articles
The NSA Cybersecurity Guide for Remote Workers
In this blog post, we cover a few key recommendations for remote workers from the NSA guide, ‘Best Practices for Securing Your Home Network.’
GraVoc Recognized on CRN’s 2023 MSP 500 List
CRN®, a brand of The Channel Company, has named GraVoc to its Managed Service Provider (MSP) 500 list in the Pioneer 250 category for 2023!
The Cybersecurity Implications of ChatGPT
Is ChatGPT a security risk? In this blog post, we explore the cybersecurity implications of ChatGPT, including the benefits and challenges.
