Android Full Disk Encryption Cold Boot Attack (2012) • Hacker News Board

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#31

Post by prutschman » Mon, Jan 04, 2016, 11:51 PM UTC

baobrien wrote: post #18

gherkin0 wrote: post #12

Earlier quoted context omitted.

It would be more difficult and model-specific, but couldn't they attach a device to read the RAM chips directly? To perform this on most modern phones, they have to disassemble it anyway to be able to toggle the power quickly enough (since there's no user-replaceable battery).

They probably wouldn't be able to attach anything to the ram directly, as the ram chips on modern phones are soldered down BGAs. To get at the pins, they'd have to de-solder them, which would heat up the chips in the process. It might be possible to get at the ram over JTAG or some other debug bus in some devices, though.

This is probably in the realm of "if you're subject to this level of attack you have bigger problems", but, I wonder if it would be possible to laser drill after-the-fact micro vias through the PCB to get at all the BGA pads with absurdly small probes.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#32

Post by lqdc13 » Mon, Jan 04, 2016, 11:56 PM UTC

Does it even matter?

You can easily get a user to install some app that has all kinds of permissions, including all their contacts, camera, mic, current and past call history, phone number, etc. They wouldn't bat an eye.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#33

Post by Pxtl » Tue, Jan 05, 2016, 12:10 AM UTC

lqdc13 wrote: post #32

Does it even matter? You can easily get a user to install some app that has all kinds of permissions, including all their contacts, camera, mic, current and past call history, phone number, etc. They wouldn't bat an eye.

That kind of user doesn't encrypt their phone.

This is more worrying for a professional locked down corporate device full of sensitive data or trade secrets. For example, I work in health studies - my worry would be patient info getting into the wrong hands.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#34

Post by kuschku » Tue, Jan 05, 2016, 12:18 AM UTC

Pxtl wrote: post #33

lqdc13 wrote: post #32

Does it even matter? You can easily get a user to install some app that has all kinds of permissions, including all their contacts, camera, mic, current and past call history, phone number, etc. They wouldn't bat an eye.

That kind of user doesn't encrypt their phone. This is more worrying for a professional locked down corporate device full of sensitive data or trade secrets. For example, I work in health studies - my worry would be patient info getting into the wrong hands.

So, what’s next – business phone implementing a heater that heats the device?

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#35

Post by greggarious » Tue, Jan 05, 2016, 12:55 AM UTC

Pxtl wrote: post #20

SchizoDuckie wrote: post #6

That was not the 'Cold Boot' I was expecting. Awesome. The paper is really nice and readable. TL;DR: Freezing the phone makes the RAM static and not clear on reboot, giving you time to sideload their custom recovery image that iterates the ram and looks for AES encryption key patterns.

After reading the article expecting a soft solution to causing a lock-up crash of the OS, I feel that your TL;DR needs to be clarified slightly: Actual freezing. Like, putting the phone in a freezer to create sub-zero temperatures.

Hence "cold boot attack"

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#36

Post by irixusr » Tue, Jan 05, 2016, 1:03 AM UTC

Johnny555 wrote: post #29

chrisfosterelli wrote: post #26

Earlier quoted context omitted.

Yes, cold boot attacks only work if they can get to the machine before it is turned off. If it has been turned off while warm, the RAM contents very very quickly degrade. This is pretty interesting since most people don't get to turn their phone off when it is stolen. In the case of the TSA you're safe, though. Fun fact: This is why during raids against cyber criminals reports claim they often dive for their computer…

Sounds like a coil of heating wire around the chips that's triggered by cryogenic temperatures entering the computer case (or the PC's case being opened) would keep their secrets safe. I.e. if triggered, motherboard power is cut off, and the LiIon battery dumps power through the heating wire and quickly bakes the chips to 500 degrees.

And it's not a very complicated circuit either.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#37

Post by irixusr » Tue, Jan 05, 2016, 1:05 AM UTC

kuschku wrote: post #34

Pxtl wrote: post #33

Earlier quoted context omitted.

That kind of user doesn't encrypt their phone. This is more worrying for a professional locked down corporate device full of sensitive data or trade secrets. For example, I work in health studies - my worry would be patient info getting into the wrong hands.

So, what’s next – business phone implementing a heater that heats the device?

Wouldn't be too hard or add too much bulk

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#38

Post by Johnny555 » Tue, Jan 05, 2016, 1:08 AM UTC

irixusr wrote: post #36

Johnny555 wrote: post #29

Earlier quoted context omitted.

Sounds like a coil of heating wire around the chips that's triggered by cryogenic temperatures entering the computer case (or the PC's case being opened) would keep their secrets safe. I.e. if triggered, motherboard power is cut off, and the LiIon battery dumps power through the heating wire and quickly bakes the chips to 500 degrees.

And it's not a very complicated circuit either.

Much easier than having to stay within easy reach of the computer's power switch at all times. Though I suspect that there are a very limited number of people in the world that actually face a threat of police coming into their home with a flask of liquid nitrogen to try to do a key recovery of latent data in RAM. This is probably the same set of people that are worried that someone will spend hundreds of thousands of dollars with an electron microscope to try to recover data from their hard drive.

I'd bet that most people that think they are in this risk category do not have strong enough security practices to prevent data from being cracked by other means.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#39

Post by asuffield » Tue, Jan 05, 2016, 1:46 AM UTC

awqrre wrote: post #5

blakes wrote: post #2

I'd be much more interested in this attack if they could get the keys from a phone with a locked bootloader. I'd assume, encrypted or not, physical access to a phone with an unlocked bootloader means it's owned.

Locked bootloader should not have anything to do with encrypted user data being accessible or not... With a locked bootloader on Android devices, it can be difficult to flash a Custom ROM but your password won't help in that case... your password/pin should be used to decrypt your data.

There are a couple more dimensions on recent (more recent than this article) models running M. There's a TEE (~android TPM equivalent) chip involved in encrypting user data, it knows whether your bootloader is locked or not, and it will not yield the keys to locked user data when running in unlocked mode.

Re: Android Full Disk Encryption Cold Boot Attack (2012)

#40

Post by [deleted] » Tue, Jan 05, 2016, 2:31 AM UTC

greggarious wrote: post #35

Pxtl wrote: post #20

Earlier quoted context omitted.

After reading the article expecting a soft solution to causing a lock-up crash of the OS, I feel that your TL;DR needs to be clarified slightly: Actual freezing. Like, putting the phone in a freezer to create sub-zero temperatures.

Hence "cold boot attack"

[deleted]