BitLocker, Windows' built-in encryption tool, no longer trusts your SSD's hardware protection

After reports of widespread flaws in hardware-based SSD encryption, Microsoft has pushed out an update that defaults BitLocker protection to software-based AES encryption.

Credit: ID 102897049 © Nikolay Antonov | Dreamstime.com

To paraphrase Fox Mulder, trust no self-encrypting SSD. As of the latest Windows 10 update, Microsoft’s BitLocker encryption tool that’s built into Pro and Enterprise versions will no longer assume that self-encrypting SSDs are, you know, actually securing their data. After researchers demonstrated last year that flaws in many self-encrypting SSDs could let baddies bypass that encryption thanks to a mixture of poor security implementations and secret Master Passwords set by the SSD manufacturers, Microsoft has closed that potential loophole by having BitLocker not trust hardware-based encryption by default. 

Swift on Security, the pseudonymous infosec Twitter rockstar, first noticed the tweak, which Microsoft published on September 24 as part of the KB4516071 update: “Changes the default setting for BitLocker when encrypting a self-encrypting hard drive,” the update reads. “Now, the default is to use software encryption for newly encrypted drives. For existing drives, the type of encryption will not change.”

That means that any SSDs you secure with BitLocker will now rely on software-based AES encryption performed by your processor, regardless of whether the drive claims to perform its own hardware-based encryption.

If you trust your SSD’s encryption technique, you can still tell BitLocker to use that instead, but now that’s an opt-in feature rather than the default. Alternatively, if you don’t trust your self-encrypting SSDs firmware any longer and you already use BitLocker, you’ll need to decrypt it, then encrypt it again to blow away the existing hardware-based reliance and move to BitLocker’s software-based encryption instead.

Our beginner’s guide to BitLocker can help you start using Microsoft’s encryption tool, though you’ll need specific hardware features and the Pro or Enterprise version of Windows 10 to access it. Home versions of Windows 10 don’t support BitLocker.

It’s a shame that self-encrypting SSDs can’t be fully trusted to be secure—that’s their proverbial One Job. But Microsoft deserves props for providing a safety net with BitLocker rather than letting end users potentially be lulled into thinking their data is protected when it’s not.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Brad Chacos

Brad Chacos

PC World (US online)
Show Comments

Brand Post

Shining a light on creativity

MSI has long pushed the boundaries of invention with its ever-evolving range of laptops but it has now pulled off a world first with the new MSI Creative 17.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?