Article looks a little dated, based on the fact that the test phone is an original Galaxy Nexus and only mentions Android 4.0. I did a search on the Internet Archive and see caches of this page going back at least as far as 2013: https://web.archive.org/web/20130115000000*/https://www1.inf... You may want to update the submission with a year.
Android Full Disk Encryption Cold Boot Attack (2012)
11–20 of 53 posts
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#12Earlier quoted context omitted.
Locked bootloader should not have anything to do with encrypted user data being accessible or not... With a locked bootloader on Android devices, it can be difficult to flash a Custom ROM but your password won't help in that case... your password/pin should be used to decrypt your data.
It does, because they can't retrieve the keys from memory otherwise - Unlocking the bootloader is essentially opening the phone up to malicious code execution by anyone with physical access.
It would be more difficult and model-specific, but couldn't they attach a device to read the RAM chips directly? To perform this on most modern phones, they have to disassemble it anyway to be able to toggle the power quickly enough (since there's no user-replaceable battery).
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#13I'd be much more interested in this attack if they could get the keys from a phone with a locked bootloader. I'd assume, encrypted or not, physical access to a phone with an unlocked bootloader means it's owned.
[deleted]
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#14I'd be much more interested in this attack if they could get the keys from a phone with a locked bootloader. I'd assume, encrypted or not, physical access to a phone with an unlocked bootloader means it's owned.
Locked bootloader should not have anything to do with encrypted user data being accessible or not... With a locked bootloader on Android devices, it can be difficult to flash a Custom ROM but your password won't help in that case... your password/pin should be used to decrypt your data.
Your right, it doesn't have anything to do with user data being accessible, but an unlocked bootloader will mean the barrier to finding a vulnerability is much lower than otherwise.
A locked bootloader is an essential line of defense.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#15It sounds to me like this will not work if I actually power down my device before the attacker gets their hands on it, is that correct? (I tend to power down my phone before going through TSA lines, for example)
It appears to me that RAM content is not cleared completely when you power down the device. Encryption keys may still be present in memory So powered down, you freeze the phone, which keeps the RAM at its current state, and then with some magic tricks you can read that memory. So powering down is not enough. In the future I guess powering down needs an extra action, wiping memory first.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#16I'd be much more interested in this attack if they could get the keys from a phone with a locked bootloader. I'd assume, encrypted or not, physical access to a phone with an unlocked bootloader means it's owned.
Locked bootloader should not have anything to do with encrypted user data being accessible or not... With a locked bootloader on Android devices, it can be difficult to flash a Custom ROM but your password won't help in that case... your password/pin should be used to decrypt your data.
Unlocking the bootloader - a prequisite for loading the ram dumping software - causes the data partitions and cache to be wiped. This might not clear the keys from ram, but now the attacker has to find a way to dump the data from flash before unlocking the bootloader for the keys to be of use.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#17[deleted]
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#18Earlier quoted context omitted.
It does, because they can't retrieve the keys from memory otherwise - Unlocking the bootloader is essentially opening the phone up to malicious code execution by anyone with physical access.
It would be more difficult and model-specific, but couldn't they attach a device to read the RAM chips directly? To perform this on most modern phones, they have to disassemble it anyway to be able to toggle the power quickly enough (since there's no user-replaceable battery).
They probably wouldn't be able to attach anything to the ram directly, as the ram chips on modern phones are soldered down BGAs. To get at the pins, they'd have to de-solder them, which would heat up the chips in the process. It might be possible to get at the ram over JTAG or some other debug bus in some devices, though.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#19It sounds to me like this will not work if I actually power down my device before the attacker gets their hands on it, is that correct? (I tend to power down my phone before going through TSA lines, for example)
It appears to me that RAM content is not cleared completely when you power down the device. Encryption keys may still be present in memory So powered down, you freeze the phone, which keeps the RAM at its current state, and then with some magic tricks you can read that memory. So powering down is not enough. In the future I guess powering down needs an extra action, wiping memory first.
In this particular case, the freezing happens while the power is on with the data you want in RAM. If the phone has already been switched off without freezing, it will lose the contents of its RAM pretty quickly.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#20That was not the 'Cold Boot' I was expecting. Awesome. The paper is really nice and readable. TL;DR: Freezing the phone makes the RAM static and not clear on reboot, giving you time to sideload their custom recovery image that iterates the ram and looks for AES encryption key patterns.
After reading the article expecting a soft solution to causing a lock-up crash of the OS, I feel that your TL;DR needs to be clarified slightly:
Actual freezing. Like, putting the phone in a freezer to create sub-zero temperatures.