Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/1/2008
07:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Freezing the Cold-Boot Attack

Researcher reveals new technologies he built to combat attacks that crack disk encryption on machines

A security expert next week at Black Hat USA will reveal the technical details of methods he developed for protecting an encrypted machine against the cold-boot attack recently discovered by researchers at Princeton University .

The software-based techniques defend against so-called cold boot attacks on machines that were recently shut down or are in hibernate or screen-lock modes, by protecting the encryption keys themselves. The cold boot attack basically takes advantage of a brief window when cryptographic keys remain stored in DRAM at shutdown or in sleep mode to then retrieve those keys.

To date, most preventative measures have required users to turn off their machines when they were finished, and to then sit and watch them for about five minutes, says Patrick McGregor, CEO of BitArmor, which has built technology to defend against cold-boot attacks.

“Some people have dismissed the cold boot attack as a minor issue, but that’s not true. To pull off the attack, all you have to do is literally stick a USB into the laptop you get your hands on,” McGregor says. “It doesn’t require any technical skill -- you can easily get automated tools to perform the attack for you.”

The epidemic of stolen laptops has brought the vulnerability to the fore: last year, over 600,000 laptops were stolen from airports alone, McGregor notes. “And all the information on those machines is vulnerable to cold-boot attacks.”

McGregor and his team at BitArmor have developed a few technologies to protect against these attacks. One automatically scrubs encryption keys stored in memory when the machine hibernates or is shut down. “So if someone grabs the device, they can’t access anything,” he says.

It basically overwrites the memory that contains the cryptographic keys. “This uses advanced techniques that take advantage of how memory works in hardware,” he says. “Since cold boot attacks can boot an alternative operating system to which they dump the contents of the memory to sift through it for keys, we make sure the keys are erased before the OS is booted.”

As for the chilling cool-down attack, the Princeton researchers demonstrated to extend the availability of crypto keys in DRAM, McGregor and his team have built a tool that uses the machine’s temperature sensor to prevent such a breach. “We can detect when people try to cool down the machine [so they can] keep the memory from fading, and the [method] destroys the keys and shuts down the computer,” he says.

BitArmor also creates a virtual secure enclave for crypto keys in software, McGregor says. “[It’s] a virtual, protected area for keys to be used in a system. So cold boot is not able to access any of the keys for encryption,” he says. “It’s as if we created a virtual piece of hardware where the keys would be stored and utilized.”

McGregor says BitArmor has added these technologies to its DataControl software, although the improvements have not been formally announced. He'll drill down into those technologies on August 7 at Black Hat in Las Vegas.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • BitArmor Systems Inc.

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: Our Endpoint Protection system is a little outdated... 
    Current Issue
    The Year in Security: 2019
    This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-10694
    PUBLISHED: 2019-12-12
    The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1....
    CVE-2019-10695
    PUBLISHED: 2019-12-12
    When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user�s username and password were exposed in the job�s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the ...
    CVE-2019-5085
    PUBLISHED: 2019-12-12
    An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow, resulting in heap corruption. An attacker can send a packet to trigger this vulnerability.
    CVE-2019-5090
    PUBLISHED: 2019-12-12
    An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an out-of-bounds read, resulting in information disclosure. An attacker can send a packet to trigger this vulner...
    CVE-2019-5091
    PUBLISHED: 2019-12-12
    An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an infinite loop, resulting in a denial of service. An attacker can send a packet to trigger this vulnerability.