EMZETT.Bypassing: how login protection is circumvented and how to defend
In short: “Bypassing” means getting around a protection measure instead of breaking it. At computer startup this mainly concerns the Windows login password: it protects only the running system, not the data on the disk.
In more detail: Whoever has physical access to a computer can start it with another operating system (USB stick), remove the disk or trick the password system. The login password is not even needed because the files on the disk are unencrypted. Defense therefore consists of several layers protecting startup and data.
In Depth
Why the Windows password alone is not enough:
- Windows checks the password only when Windows is running. If someone starts another system (live Linux, rescue media), they see the drive like a USB stick and read the files.
- The same applies if the disk is removed and put into another computer.
- Account passwords (SAM database) can be reset or read offline if the disk is unencrypted.
Typical bypass paths (to understand the risks):
| Attack path | Cause | Protection |
|---|---|---|
| Start from USB/CD with a foreign system | Free boot order, no firmware password | UEFI password, block boot from removable media, Secure Boot |
| Remove disk, read in another computer | Data unencrypted | BitLocker/drive encryption |
| Reset password offline | Local accounts, unencrypted | Encryption, Microsoft account/MFA, Windows Hello |
| Manipulated bootloader (bootkit) | No signature protection | Secure Boot, TPM measurement |
| Reset firmware password | Pull CMOS battery or jumper | Chassis lock, encryption, security seals |
| Cold boot/DMA attacks (reading memory) | Key in RAM, open interfaces | TPM+PIN, kernel DMA protection, Thunderbolt security |
Layered defense (defense in depth) for a Windows 11 device:
- Set a UEFI password, block boot from USB.
- Enable Secure Boot and TPM 2.0 (Windows 11 requires them anyway).
- Use BitLocker with TPM + PIN, keep the recovery key safe.
- Strong sign-in method (Windows Hello, long password, MFA).
- Install updates for firmware and system.
- Secure devices physically (lock, room), remotely lock/wipe lost devices.
Remember: Access protection at operating-system level and data protection at drive level are two different things. Only encryption protects the data when the operating system does not control what is started.
Note: Bypassing other people’s access without permission is a criminal offense (§§ 202a ff. German Criminal Code). This knowledge serves to protect your own devices and for authorized testing.
See also: BitLocker, Secure Boot, TPM and TPM 2.0