Authentication bypass is the process by which an adversary bypasses the Full Disk Encryption that protects access to a digital device. An adversary can achieve authentication bypass through human error, weak passwords, or technical exploits.
An adversary can achieve authentication bypass in the following ways:
- Accessing the device while it is turned on (and therefore its encryption is not effective).
- Finding the encryption password written down somewhere.
- Making the device owner provide the encryption password by using interrogation techniques including, in some contexts, physical violence.
- Visual interception: watching the device owner type the encryption password through a hidden camera or an infiltrator or informant.
- Brute force: guessing the encryption password through repeated, automated authentication attempts.
- Compromising the device either through remotely-installed malware or physical access.
- Exploiting a flaw at the implementation level of the encryption process.
Used in tactics: Incrimination
Mitigations
| Name | Description |
|---|---|
| Bug search | Before entering a password in a room where covert video surveillance devices may be present, you can conduct a bug search to locate such devices and eventually remove them. |
| Digital best practices | You can follow digital best practices, and in particular use security-oriented operating systems with Full Disk Encryption (FDE) and strong passwords, to make it harder for an adversary to bypass authentication on your digital devices. For example:
|
| Tamper-evident preparation | You can use tamper-evident preparation to detect when a device has been physically accessed. Once a device has been physically accessed by an adversary, you should consider it compromised and never authenticate to it again. This is because, in a worst-case scenario, the adversary may have copied the device's data and compromised its firmware so that when you enter your password, they can remotely obtain it and use it to decrypt the data. |
Used in repressive operations
| Name | Description |
|---|---|
| Repression of Lafarge factory sabotage | Investigators seized several encrypted smartphones in the raids and attempted to access their encrypted data, with varying results depending on the phone[4]:
|
| Repression against Zündlumpen | In some of the April 2022 raids, cops seized smartphones immediately after entering and plugged them into power banks, presumably to prevent them from shutting down and reverting to an encrypted state[5]. |
| Bure criminal association case | Investigators bypassed the authentication of five encrypted storage devices found in raids[6]:
|