Disk encryption broken due cooled memory

February 22, 2008

The hard disk and file encryption Systems Bitlocker (Vista), dm-crypt, TrueCrypt and Apples FileVault were previously known to be save. This is no longer the case! Researchers from the Princeton University published in their blog a video showing how to extract the password stored in the memory. The attack vector is in this case the DRAM, which does not lose the state after a power cut. It takes some seconds or even minutes, by cooling the memory (-50Â°C) this can be extended even further.

The researcher boot than a mini program which dumps the memory onto a USB hard disk. A second program searches in this dump than for the password. Take a look at the video it is really well done!

My first thought to be at least a little bit secure is not use the standby modus but to switch off the computer completely. This at least limits the opportunity for an attacker to a few minutes. But this is not a solution. A solution would be a special RAM for storing the password which clears the memory when the power is cut. This could be done by a capacitor which provides enough power to clear the memory.

Has someone a better/other idea?

In IT Security, Linux | 2 Comments

2 Comments »

RSS feed for comments on this post. TrackBack URI

A quite easy security improvement would be to overwrite the stored password when the computer is shut down, such that existing systems could at least limit the attack scenarios.

But still this doesn’t add any security enhancement for the online version.
The only solution for the online case I can think of at the moment is the one you already mentioned. It could be integrated as a fixed device, such that removing it from the circuit would require more work and therefore soon become impractical.

Comment by Markus — February 23, 2008 #
The question is, if TPM could help with a secure password storage.

Comment by admin — February 23, 2008 #

Disk encryption broken due cooled memory

2 Comments »

Leave a comment