The real issue here is the Elevation of Privilege that takes a non-admin to SYSTEM (the root of Windows) even on a BitLocker (Microsoft's hard disk encryption) protected machine. While exploiting the bug - which, we are assured, Microsoft is 'working on' - does require access to a computer, it is still a concern.

He reveals that exploiting the bug takes nothing more than pressing Shift + F10 during the upgrade and you can then access the Command Prompt in the Windows PE (Preinstallation Environment) used during the upgrade. Obviously, attackers would likely not consider brute force attacks against the BitLocker recovery password and would resort to attacking weaker links in the chain.The reason for this is that BitLocker is disabled during the update process, as security expert Sami Laiho points out. Each group of six digits must be divisible by 11, which is used as a check against keys mistyped by the user when entering the groups.Įach of the 8 groups of 6 digits must be less than 720,896 (which is 2^16 *11) indicating that each of the eight groups has 2^16 possible values, and altogether this means that there are (2^16)^8 possible combinations which is ~3.4028 x 10^38 combinations.Īssuming we could somehow process 500 trillion passwords an hour (which would be 3,623 times more than the ~138 billion passwords per hour capability of a desktop computer in 2008 under 10% load), it would still take us ~7.7 x 10^19 years to brute force crack this 48 character numerical recovery password. The recovery password is created starting with a 128-bit key, split into 8 groups of 16 bits of entropy, written as a value between 0 and 65,535 (2^16 - 1). I've done some further analysis, and I believe I have determined that brute force attacking the recovery password would not be a good use of anyone's time.that is assuming my math is correct.

Crack bitlocker