Hello and welcome to the Friday, June 12, 2006 edition of the Sands United Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu credit certificate program in cyber security engineering.

Well, a nightmare eclipse is added again. It's not just Saturday Wednesday, but now also Saturday, Thursday, with another attack against Bitlocker.

And this one actually involves Windows Defender,

which is another favorite target of a nightmare eclipse.

So the problem here is that if a victim is starting an unattended virus scan

using a Windows Defender,

and then attacker is able to trigger a reboot on the system

and then go into the Windows recovery environment.

The virus scandal starts.

That's, well, by design.

It's really more featured than a buck, really.

And in that case, then, well, the Bitlocker partition will be unlocked

because, after all, the virus scan needs access to it. Well, the trick is that this can basically

trickered just by copying a specific XML file to the root partition. It will then be picked up by the Windows Defender process in the recovery state

in order to then unlock the BitLocker partition.

Interesting vulnerability, and I'm not sure how much this is, you know, intended functionality or actually a bug.

We'll have to see how it all falls out and what Microsoft's comment will be on this.

But yes, yet another reason not to leave your laptops and such unattended

and to rely not just on BitLocker to protect your systems.

Well, and on Tuesday, Yvanti published an advisory with patches for two vulnerabilities in

...