Perimeter

8/1/2008
07:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Freezing the Cold-Boot Attack

Researcher reveals new technologies he built to combat attacks that crack disk encryption on machines

A security expert next week at Black Hat USA will reveal the technical details of methods he developed for protecting an encrypted machine against the cold-boot attack recently discovered by researchers at Princeton University .

The software-based techniques defend against so-called cold boot attacks on machines that were recently shut down or are in hibernate or screen-lock modes, by protecting the encryption keys themselves. The cold boot attack basically takes advantage of a brief window when cryptographic keys remain stored in DRAM at shutdown or in sleep mode to then retrieve those keys.

To date, most preventative measures have required users to turn off their machines when they were finished, and to then sit and watch them for about five minutes, says Patrick McGregor, CEO of BitArmor, which has built technology to defend against cold-boot attacks.

“Some people have dismissed the cold boot attack as a minor issue, but that’s not true. To pull off the attack, all you have to do is literally stick a USB into the laptop you get your hands on,” McGregor says. “It doesn’t require any technical skill -- you can easily get automated tools to perform the attack for you.”

The epidemic of stolen laptops has brought the vulnerability to the fore: last year, over 600,000 laptops were stolen from airports alone, McGregor notes. “And all the information on those machines is vulnerable to cold-boot attacks.”

McGregor and his team at BitArmor have developed a few technologies to protect against these attacks. One automatically scrubs encryption keys stored in memory when the machine hibernates or is shut down. “So if someone grabs the device, they can’t access anything,” he says.

It basically overwrites the memory that contains the cryptographic keys. “This uses advanced techniques that take advantage of how memory works in hardware,” he says. “Since cold boot attacks can boot an alternative operating system to which they dump the contents of the memory to sift through it for keys, we make sure the keys are erased before the OS is booted.”

As for the chilling cool-down attack, the Princeton researchers demonstrated to extend the availability of crypto keys in DRAM, McGregor and his team have built a tool that uses the machine’s temperature sensor to prevent such a breach. “We can detect when people try to cool down the machine [so they can] keep the memory from fading, and the [method] destroys the keys and shuts down the computer,” he says.

BitArmor also creates a virtual secure enclave for crypto keys in software, McGregor says. “[It’s] a virtual, protected area for keys to be used in a system. So cold boot is not able to access any of the keys for encryption,” he says. “It’s as if we created a virtual piece of hardware where the keys would be stored and utilized.”

McGregor says BitArmor has added these technologies to its DataControl software, although the improvements have not been formally announced. He'll drill down into those technologies on August 7 at Black Hat in Las Vegas.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • BitArmor Systems Inc.

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    RIP, 'IT Security'
    Kevin Kurzawa, Senior Information Security Auditor,  11/13/2018
    Understanding Evil Twin AP Attacks and How to Prevent Them
    Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: This comment is waiting for review by our moderators.
    Current Issue
    Flash Poll
    Online Malware and Threats: A Profile of Today's Security Posture
    Online Malware and Threats: A Profile of Today's Security Posture
    This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-17906
    PUBLISHED: 2018-11-19
    Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
    CVE-2018-9209
    PUBLISHED: 2018-11-19
    Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2
    CVE-2018-9207
    PUBLISHED: 2018-11-19
    Arbitrary file upload in jQuery Upload File <= 4.0.2
    CVE-2018-15759
    PUBLISHED: 2018-11-19
    Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perfo...
    CVE-2018-15761
    PUBLISHED: 2018-11-19
    Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges...