Software claims to be able to decrypt BitLocker To Go flash drives in less than 20 minutes.

But this isn’t exactly a kid in his mother’s basement. The program is from Passware Inc., which develops password recovery, decryption and cyber forensics solutions to corporations, law enforcement agencies, and the government. They showed their talents this week at the 2010 International Training Conference by High Technology Crime Investigation Association in Atlanta.

Their product, Passware Kit Forensic 10.1 that allows for cracking of BitLocker To Go USB Disks. Passware’s BitLocker decryption capabilities, first introduced in November 2009, support all types of hard disk images, including raw image files, images created with Guidance EnCase or any other forensic tool.

“This enhanced solution for computer forensics allows the entire memory capture and decryption process to take no more than 40 minutes regardless of the complexity of the password,” said Dmitry Sumin, president of Passware, Inc.

This new ability includes live target memory acquisition and BitLocker encryption key recovery that allows computer forensics to gain easily full access to the contents of the encrypted USB disk. Passware Kit Forensic now also supports BitLocker To Go images saved as Virtual Hard Disks (VHD) — a format that allows attaching BitLocker hard disks in Windows 7 and Server 2008 without using any third-party disk mounting tools.

You can get your hands on Passware Kit 10.1 for about $800.

BitLocker Drive Encryption is a full disk encryption feature included with the Ultimate and Enterprise editions of Windows Vista and 7, as well as the Windows Server 2008 and Windows Server 2008 R2 server platforms. By default it uses the AES encryption algorithm in CBC mode with a 128 bit key, combined with the Elephant diffuser for additional disk encryption specific security not provided by AES.

Take a seven dollar can of compressed air from any office supply store. Flip it over, and spray its liquid nitrogen on a computer’s DRAM, or digital random access memory. Reboot the computer, or even extract the DRAM chip and clone it, then run a few relatively simple programs. Nothing that would defeat an intermediate level programmer.

It’s that easy to bypass the most popular forms of hard disk encryption software. From Windows Vista, to Mac OSX, to various flavors of Linux, it appears that all major operating systems are highly vulnerable.

Conventional wisdom held that DRAM memory was rapidly volatile, causing all of its information to fade as soon as power to a computer is cut. However, researchers with Princeton’s School of Engineering and Applied Science department have recently proved that false.

By tipping the can of air upside down over a laptop’s DRAM chips, the nitrogen gas freezes the chip within seconds. When it’s frozen, the memory can stay fresh for longer than ten minutes — more than enough time to steal the encryption keys that allow easy access to the hard drive’s data.

In their paper, titled, “Lest We Remember: Cold Boot Attacks on Encryption Keys,” they say, “We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount successful attacks on popular disk encryption systems using no special devices or materials.”

The revelation and airtight research have knocked the computer world for a spin, as laptops containing military information to proprietary corporate research are now wide open.
In their paper, the researchers observe that many computers with inefficient cooling systems do not need the benefit of liquid nitrogen at all. The DRAM stays cool enough on its own to simply reboot the computer with the proper access tools.

The researchers end their abstract by noting, “Though we discuss several strategies for partially mitigating these risks, we know of no simple remedy that would eliminate them.”

See also: The New York Times