Hello, welcome to the Wednesday, November 14th, 2018 edition of the Sansonet Storms on a Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Microsoft's patched Tuesday, of course, is at the top of the news today and we got the patches for 63 different vulnerabilities,

12 of which are rated critical by Microsoft.

Now, two of the vulnerabilities had already been publicly disclosed.

The first one is the ALPC privilege escalation vulnerability that was released via

Twitter by Sandbox Escaper, very similar to a vulnerability that the same individual released a few

months prior, also via Twitter. Microsoft isn't aware of this vulnerability being used in any public exploits.

The second one we have talked about recently, and that's the problem with BitLocker on Windows.

And Microsoft published a patch for this as well as an advisory. There are two problems here. First one is that Bitlocker

does rely on hardware encryption in drives. And that sort of makes sense if you think about it.

There is really no need to spend extra CPU power in encrypting data that would be encrypted on the hard drive anyway.

So BitLocker ties in with these hard drive encryption technologies that have been popping up in various hard drives.

But recently we learned that some of these hard drive encryption technologies aren't really all that good and can easily

be bypassed. So the advisory that Microsoft released was that if you don't trust your hard

drive, you can always just force BitLocker to encrypt the drive using its software encryption.

Now the second issue and that's where the patch comes in, that's CVE 2018-8566,

is an unspecified condition where BitLocker just stops encrypting a particular drive

and this is being addressed with this patch.

So if you do want to play it safe, you can always just follow the Microsoft Advisory

and enable the software encryption in BitLocker, no matter whether or not your hard drive

does support hardware encryption. Probably doesn't hurt from a security point of view,

but you may get a little performance hit if you do enable this double encryption.

...