Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/1/2008
07:45 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Freezing the Cold-Boot Attack

Researcher reveals new technologies he built to combat attacks that crack disk encryption on machines

A security expert next week at Black Hat USA will reveal the technical details of methods he developed for protecting an encrypted machine against the cold-boot attack recently discovered by researchers at Princeton University .

The software-based techniques defend against so-called cold boot attacks on machines that were recently shut down or are in hibernate or screen-lock modes, by protecting the encryption keys themselves. The cold boot attack basically takes advantage of a brief window when cryptographic keys remain stored in DRAM at shutdown or in sleep mode to then retrieve those keys.

To date, most preventative measures have required users to turn off their machines when they were finished, and to then sit and watch them for about five minutes, says Patrick McGregor, CEO of BitArmor, which has built technology to defend against cold-boot attacks.

“Some people have dismissed the cold boot attack as a minor issue, but that’s not true. To pull off the attack, all you have to do is literally stick a USB into the laptop you get your hands on,” McGregor says. “It doesn’t require any technical skill -- you can easily get automated tools to perform the attack for you.”

The epidemic of stolen laptops has brought the vulnerability to the fore: last year, over 600,000 laptops were stolen from airports alone, McGregor notes. “And all the information on those machines is vulnerable to cold-boot attacks.”

McGregor and his team at BitArmor have developed a few technologies to protect against these attacks. One automatically scrubs encryption keys stored in memory when the machine hibernates or is shut down. “So if someone grabs the device, they can’t access anything,” he says.

It basically overwrites the memory that contains the cryptographic keys. “This uses advanced techniques that take advantage of how memory works in hardware,” he says. “Since cold boot attacks can boot an alternative operating system to which they dump the contents of the memory to sift through it for keys, we make sure the keys are erased before the OS is booted.”

As for the chilling cool-down attack, the Princeton researchers demonstrated to extend the availability of crypto keys in DRAM, McGregor and his team have built a tool that uses the machine’s temperature sensor to prevent such a breach. “We can detect when people try to cool down the machine [so they can] keep the memory from fading, and the [method] destroys the keys and shuts down the computer,” he says.

BitArmor also creates a virtual secure enclave for crypto keys in software, McGregor says. “[It’s] a virtual, protected area for keys to be used in a system. So cold boot is not able to access any of the keys for encryption,” he says. “It’s as if we created a virtual piece of hardware where the keys would be stored and utilized.”

McGregor says BitArmor has added these technologies to its DataControl software, although the improvements have not been formally announced. He'll drill down into those technologies on August 7 at Black Hat in Las Vegas.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • BitArmor Systems Inc.

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 10/30/2020
    6 Ways Passwords Fail Basic Security Tests
    Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
    'Act of War' Clause Could Nix Cyber Insurance Payouts
    Robert Lemos, Contributing Writer,  10/29/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    How to Measure and Reduce Cybersecurity Risk in Your Organization
    In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
    Flash Poll
    How IT Security Organizations are Attacking the Cybersecurity Problem
    How IT Security Organizations are Attacking the Cybersecurity Problem
    The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-4588
    PUBLISHED: 2020-10-30
    IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 184579.
    CVE-2020-4584
    PUBLISHED: 2020-10-30
    IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184574.
    CVE-2020-7759
    PUBLISHED: 2020-10-30
    The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://v...
    CVE-2020-7760
    PUBLISHED: 2020-10-30
    This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vu...
    CVE-2020-27014
    PUBLISHED: 2020-10-30
    Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash. An attacker must first obtain the ability to execute high-privileged code on the targ...