2

I assume if I use Bitlocker on Windows 10 on a laptop with a TPM chip without a password, then if the laptop gets stolen, then the attacker can simply turn the machine on and then he gets to the windows logon screen without any problems.

To prevent this I assume I need the preboot pin, but how secure is that (with a 9 character numerical pin)?

The scenario I want to protect myself against:

  1. A simple thief steals the notebook
  2. They want to access the data by basic "googling around" hacking skills, like using a tool or typing in random passwords.

Meanwhile I will have time to change all the passwords of the online services, disable VPN accounts, etc. that were used on that notebook, so even if they eventually gain access, our systems will stay secure.

forest
  • 64,616
  • 20
  • 206
  • 257
Sevron
  • 180
  • 8
  • Shouldn't a strong password be enough for your scenario? As in to gain access to your data the thief would have to guess the password and that would be impossible if that is a strong passphrase. If I am correct bitlocker doesn't decrypt the drive until you are logged in (please correct me if I am wrong in this) – Wealot Jan 22 '18 at 15:23
  • @Wealot with all the (easy) ram remanence attacks on bitlocker, a pin actually improve security by a lot. Bitlocker *does* decrypt the drive as soon as it boots to the operating system – fjch1997 Jul 07 '19 at 03:54

1 Answers1

2

The scenario I want to protect myself against: 1. A simple thief steals the notebook 2. They want to access the data by basic "googling around" hacking skills, like using a tool or typing in random passwords.

A 9 digit PIN should be sufficient to protect against an attacker of this level of sophistication for long enough for you to change the passwords on all your online services. A TPM will ensure that only a trusted computer can unseal it, in combination with your PIN. Since the attacker has the whole computer, all that is needed is the PIN. What matters now is several factors:

  • How motivated your attacker is (are you a random victim of this attacker, one of 100 others?).
  • How clever he is (one person's "basic Googling skills" is another person's advanced Google-fu).
  • How long it will take you to notice the theft and to change your passwords.

Both defenders and attackers need to do cost-benefit analysis. You have to determine how much of your time and effort your assets are worth, but the attacker has to do the same. If it takes them two weeks to gain access to your computer, that is two weeks of lost opportunities for theft. Why spend all that time on your computer if it would be more profitable to steal three more computers in that time?

forest
  • 64,616
  • 20
  • 206
  • 257
  • I was about to submit a new answer saying this is wrong, but it's close enough that I will just add a comment. The TPM is an active device that has (is supposed to have) protection against brute force. Multiple wrong PINs will (is supposed to) lock the TPM preventing access to the system without entering the recovery key or unlocking the TPM. There is no realistic chance of cracking a PIN. There is a much more realistic chance that a simple thief will take the laptop to their techie friend to clear the TPM, clear the BIOS settings, and load an OS onto the freshly formatted drive. – Doug Oct 03 '21 at 13:07