Encrypting your hard drive has been touted as the ultimate in data  protection. But new research shows that a savvy attacker with a can of compressed air and good timing can access encryption keys used by Vista's BitLocker, the Mac's FileVault, and other well-known encryption tools -- and then your data.
While a computer is running, data and the encryption keys used by full-disk encryption systems are held in dynamic random-access memory. Researchers at Princeton University's Center for Information Technology Policy took advantage of the fact that data persists on DRAM modules even when a computer is turned off.
Researcher Ed Felten wrote on his blog, "Virtually everybody, including experts, will tell you that DRAM contents are lost when you turn off the power . But this isn't so."
The data in DRAM modules persists only for a minute or less at room temperature, but the decay of data can be significantly slowed by using an air-spray duster to cool the chips (a few sprays can lower the temperature to -50 degrees Celsius). Then, with specialized software, "someone could carry out our attacks against a target computer in a matter of minutes," Felten wrote. The Princeton team did not disclose the source code or software used in the cold-boot attack.
Widespread Vulnerability
"Most disk-encryption systems can be defeated if the computer is stolen or accessed while it is in sleep mode or in a password-protected screen saver," Felten wrote. Vista's BitLocker "is also sometimes vulnerable even when the computer is completely off."
Microsoft acknowledged that the attack could occur. "Like all full-volume encryption products, BitLocker has a key in memory when the system is running in order to encrypt/decrypt data on the fly for the drive(s) in use. If a system is in 'sleep mode' it is, in effect, still running," Microsoft said in a statement provided to NewsFactor.
Encryption vendor PGP was not mentioned in the report, but CTO Jon Callas told NewsFactor that "though this is primarily a hardware attack, PGP's Whole Disk Encryption functionality could be as vulnerable as any other vendor's full-disk encryption products." The company has asked the publishers of the report how it can protect against this type of attack. (continued...)
|
Analysts See iPad Price Drop, with Some Cannibalization
Bar Codes Go Mobile, Get Hip Again
'Dead Simple, Dirt Cheap' JooJoo Tablet Shipping Soon
Google May Add Facebook, Twitter Links to Gmail
IBM's New POWER7 Servers Save Energy with Big Loads
IBM Opens Eco-Friendly, Cloud-Focused Data Center