Researchers release 'cold boot' attack utilities

None

cant see how it really does anything useful, a mobo bios can take 30sec to boot before any drive is accessed, then the bios would have to have the floppy drive as the primary boot check

Easy to defeat?

Does this attack work if you have "quick POST" turned off in the BIOS so the BIOS does a full memory test? Won't the crypto keys get nuked by the BIOS.

Or... there must be some memory the BIOS is almost guaranteed to flatten on boot (e.g. where does the boot loader get loaded?!), the OS should allocate that specific bit of physical memory for its crypto keys... if the keys are long > 1 sector you can still flatten 1 sectors worth, 512 bytes is a lot to guess for a crypto key!

Both ways, reboot & the keys get flattened by the BIOS.

Chris

A boon for the crackers as well

It is not just hackers or computer forensics.

The problem with the OS regenerate keys, is you have to keep somethings outside of the encrypted area to allow for that. So, for example if you lock the computer you will have to stop logging, or expose the logs.

It is the solution but is not that simple when you wonder what wouldn't work, and how much you would have to control. You couldn't assume a write to disk, so perhaps you start buffering, and that could lead to RAM exhaustion attacks.

@Easy to defeat?

Yes - if they use your computer. A very similar method is to rip the ram straight out of the mobo (after giving it a quick blast with an upside down can of compressed air to cool it) and whack it into your own system that has quick boot on., then boot off your pendrive and get the keys out that way. And as long as you put the stick into your computer as a second stick, any areas that would get written too occurs on the first stick.

@Nigel

Doing it at the chip level is the best bet, and should have the following inputs: hard reset input, refresh loss or repowering (ie getting good power after a power loss).

As soon as any of those are detected then all the DRAM cells get wiped, likely by a single inversion of a in-chip power rail or a slight modification to the refresh logic that does a wiping in the first refresh cycle or similar.

This would make the DRAM immune to all hotswap nasties.

Timing

I believe that as soon as the power is returned to the memory, the bits would keep themselves there. The long bios memory test doesn't take nearly long enough to overwrite the entire capacity of the memory.

Seems like the safe way to take care of this would be to shut down the computer and power supply, just to cut off that pesky standby power. And possibly make sure that loads and loads of different (bad) keys are stored in memory at any given time can't help.

@Nigel

The DRAM cell that holds each bit is very simple, basically a capacitor and a transistor. Adding a hard reset to the chip would double the transistor count and halve the capacity / double the price per gigabyte.

There may be a market for "secure DRAM" that gets reset, but I doubt it.

Easy to defeat? pt2

Yes, it is that easy to defeat. I read their pdf. A full memory scan nukes it... ECC memory works too because the BIOS has to reset all the memory on boot up.

As for taking RAM out of a machine all bets are off with all encryption systems when you _own_ the hardware. Just read Hacking the Xbox!

But I'd like to see someone get the ECC RAM out of a particular server of mine in a hurry without slicing their fingers off on the damn case! The trail of blood will presumably lead directly back to the perp.

@Rich

Yes, but you only need a few kilobytes of "secure DRAM" to hold the keys; the rest can be normal DRAM.

BIOS full memory scan maybe no solution

I'm no expert, but what is the default BIOS mode?

If it's full scan, ok. But if it's not, then being in Full-scan is certainly not a workaround.

The security agency just needs to reset the BIOS.

And contrary to what has been said above by Pheet, it's futile to expect that "Hopefully the time it takes to open the machine and physically reset the BIOS means there's insufficient key material left in the RAM."

The basic hypothesis here is that the people coming it to get you have access to the computer while it's still turned on.

You can't seriously expect that they'll turn it off, then open the machine.

They will just open the machine, and when they have their screwdriver 1 inch from the BIOS reset button, ready to go, then they'll turn off, reset BIOS and turn on. 5 seconds lost, at most.

bios count

it only counts in blocks not every address,

easier to 'pop rivet' the case shut