Perimeter

8/1/2008
07:45 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Freezing the Cold-Boot Attack

Researcher reveals new technologies he built to combat attacks that crack disk encryption on machines

A security expert next week at Black Hat USA will reveal the technical details of methods he developed for protecting an encrypted machine against the cold-boot attack recently discovered by researchers at Princeton University .

The software-based techniques defend against so-called cold boot attacks on machines that were recently shut down or are in hibernate or screen-lock modes, by protecting the encryption keys themselves. The cold boot attack basically takes advantage of a brief window when cryptographic keys remain stored in DRAM at shutdown or in sleep mode to then retrieve those keys.

To date, most preventative measures have required users to turn off their machines when they were finished, and to then sit and watch them for about five minutes, says Patrick McGregor, CEO of BitArmor, which has built technology to defend against cold-boot attacks.

“Some people have dismissed the cold boot attack as a minor issue, but that’s not true. To pull off the attack, all you have to do is literally stick a USB into the laptop you get your hands on,” McGregor says. “It doesn’t require any technical skill -- you can easily get automated tools to perform the attack for you.”

The epidemic of stolen laptops has brought the vulnerability to the fore: last year, over 600,000 laptops were stolen from airports alone, McGregor notes. “And all the information on those machines is vulnerable to cold-boot attacks.”

McGregor and his team at BitArmor have developed a few technologies to protect against these attacks. One automatically scrubs encryption keys stored in memory when the machine hibernates or is shut down. “So if someone grabs the device, they can’t access anything,” he says.

It basically overwrites the memory that contains the cryptographic keys. “This uses advanced techniques that take advantage of how memory works in hardware,” he says. “Since cold boot attacks can boot an alternative operating system to which they dump the contents of the memory to sift through it for keys, we make sure the keys are erased before the OS is booted.”

As for the chilling cool-down attack, the Princeton researchers demonstrated to extend the availability of crypto keys in DRAM, McGregor and his team have built a tool that uses the machine’s temperature sensor to prevent such a breach. “We can detect when people try to cool down the machine [so they can] keep the memory from fading, and the [method] destroys the keys and shuts down the computer,” he says.

BitArmor also creates a virtual secure enclave for crypto keys in software, McGregor says. “[It’s] a virtual, protected area for keys to be used in a system. So cold boot is not able to access any of the keys for encryption,” he says. “It’s as if we created a virtual piece of hardware where the keys would be stored and utilized.”

McGregor says BitArmor has added these technologies to its DataControl software, although the improvements have not been formally announced. He'll drill down into those technologies on August 7 at Black Hat in Las Vegas.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • BitArmor Systems Inc.

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
    Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
    Yahoo Class-Action Suits Set for Settlement
    Dark Reading Staff 9/17/2018
    RDP Ports Prove Hot Commodities on the Dark Web
    Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: In Russia, application hangs YOU!
    Current Issue
    Flash Poll
    How Data Breaches Affect the Enterprise
    How Data Breaches Affect the Enterprise
    This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-6693
    PUBLISHED: 2018-09-18
    An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
    CVE-2018-16515
    PUBLISHED: 2018-09-18
    Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
    CVE-2018-16794
    PUBLISHED: 2018-09-18
    Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.
    CVE-2018-16819
    PUBLISHED: 2018-09-18
    admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.
    CVE-2018-16820
    PUBLISHED: 2018-09-18
    admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests.