One thing I've always wondered... is the PIN code or unlock pattern (and disk encryption key) protected by a hardware security module that rate limits attacks? If someone has physical access to the device and can image the flash drive, what's to keep them from brute forcing the tiny PIN code keyspace to gain access to the drive?
Android Full Disk Encryption Cold Boot Attack (2012)
21–30 of 53 posts
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#22One thing I've always wondered... is the PIN code or unlock pattern (and disk encryption key) protected by a hardware security module that rate limits attacks? If someone has physical access to the device and can image the flash drive, what's to keep them from brute forcing the tiny PIN code keyspace to gain access to the drive?
Most Android phones throttle the rate you're allowed to enter PINs if you fail multiple times in a row (from minutes to hours). You can set the phone to wipe the entire flash memory if too many PIN entries in a row fail.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#23One thing I've always wondered... is the PIN code or unlock pattern (and disk encryption key) protected by a hardware security module that rate limits attacks? If someone has physical access to the device and can image the flash drive, what's to keep them from brute forcing the tiny PIN code keyspace to gain access to the drive?
Most Android phones throttle the rate you're allowed to enter PINs if you fail multiple times in a row (from minutes to hours). You can set the phone to wipe the entire flash memory if too many PIN entries in a row fail.
But that won't help if you're up to the sort of attacker disk encryption is supposed to protect from, right? Disk encryption protects data at rest, in which case you can assume the attacker has loaded the flash into his own system and don't give a cent about Android's PIN restrictions.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#24None of this will work against a normal consumer device, since you cannot flash recovery until you do "fastboot oem unlock", which purposefully erases ALL user data. And most consumers do not walk around with unlocked bootloaders.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#25This is very similar to work done by J. Alex Halderman et al. in 2008 [1]. If you find this interesting, check out their paper. They give an example of a bitmap image in memory and its degradation over a number of seconds without power. It's a fantastic visual aid and you might be surprised by how well the data survives; if you're fast (5 seconds) it's nearly lossless.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#26It sounds to me like this will not work if I actually power down my device before the attacker gets their hands on it, is that correct? (I tend to power down my phone before going through TSA lines, for example)
Yes, cold boot attacks only work if they can get to the machine before it is turned off. If it has been turned off while warm, the RAM contents very very quickly degrade. This is pretty interesting since most people don't get to turn their phone off when it is stolen. In the case of the TSA you're safe, though.
Fun fact: This is why during raids against cyber criminals reports claim they often dive for their computer to try and turn it off before being restrained. Police can do the same thing with liquid nitrogen and a desktop machine.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#27Little reminder to the folks with Mediatek chipsets: the MTK bootloader does not support locking and you can trivially dump the entire flash (and rewrite it) at will.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#28Earlier quoted context omitted.
Most Android phones throttle the rate you're allowed to enter PINs if you fail multiple times in a row (from minutes to hours). You can set the phone to wipe the entire flash memory if too many PIN entries in a row fail.
But that won't help if you're up to the sort of attacker disk encryption is supposed to protect from, right? Disk encryption protects data at rest, in which case you can assume the attacker has loaded the flash into his own system and don't give a cent about Android's PIN restrictions.
It would if the KDF used to expand the PIN also used some per-device secret in a HSM.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#29It sounds to me like this will not work if I actually power down my device before the attacker gets their hands on it, is that correct? (I tend to power down my phone before going through TSA lines, for example)
Yes, cold boot attacks only work if they can get to the machine before it is turned off. If it has been turned off while warm, the RAM contents very very quickly degrade. This is pretty interesting since most people don't get to turn their phone off when it is stolen. In the case of the TSA you're safe, though. Fun fact: This is why during raids against cyber criminals reports claim they often dive for their computer…
Sounds like a coil of heating wire around the chips that's triggered by cryogenic temperatures entering the computer case (or the PC's case being opened) would keep their secrets safe. I.e. if triggered, motherboard power is cut off, and the LiIon battery dumps power through the heating wire and quickly bakes the chips to 500 degrees.
Re: Android Full Disk Encryption Cold Boot Attack (2012)
#30None of this will work against a normal consumer device, since you cannot flash recovery until you do "fastboot oem unlock", which purposefully erases ALL user data. And most consumers do not walk around with unlocked bootloaders.
Actually the authors dutifully note this case, explaining that "we show that cold boot attacks are more generic and allow to retrieve sensitive information, such as contact lists, visited web sites, and photos, directly from RAM, even though the bootloader is locked."