Undocumented Bypass in PGP Whole Disk Encryption

Posted by Zonk on Thursday October 4, 2007 @05:06AM from the seems-to-defeat-the-purpose dept.

A non-mouse Coward writes "PGP Corporation's widely adopted Whole Disk Encryption product apparently has an encryption bypass feature that allows an encrypted drive to be accessed without the boot-up passphrase challenge dialog, leaving data in a vulnerable state if the drive is stolen when the bypass feature is enabled. The feature is also apparently not in the documentation that ships with the PGP product, nor the publicly available documentation on their website, but only mentioned briefly in the customer knowledge base. Jon Callas, CTO and CSO of PGP Corp., responded that this feature was required by unnamed customers and that competing products have similar functionality."

1 of 316 comments (clear)

Min score:

Reason:

Sort:

Did anyone read the response? by duplicate-nickname · 2007-10-04 05:11 · Score: 5, Interesting

Seriously, customers require this so IT staff can do remote support and reboot the machine remotely. It is only enabled for one reboot, and you must have cryptographic access to enable this feature. The only threat is if someone where to enable this, not reboot, and then have the machine stolen.

Why does crap like this make it to the front page of Slashdot?

--
ÕÕ