Cryogenically frozen RAM bypasses disk encryption methods (2008)
1–10 of 36 posts
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#2this research is neat, but was also neat in 2008 when it was released
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#3https://en.wikipedia.org/wiki/TRESOR
OS X has a setting called "destroy FileVault key on standby" in `pmset` which mitigates cold boot attacks.
I kinda want the CPU/MMU to support loading encryption keys to transparently encrypt some or all of RAM (could also toss in error checking while we're at it). SGX has this in the trusted containers, but I think it makes sense for general use too.
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#4Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#5This has been a known attack vector for quite some time (hence 2008...) One of the best training courses I ever did was a forensics course and this was one of the first techniques taught for a "black bag", along with faraday cage bags for all the things.
I have never gotten to use it irl though.
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#6That's nice first.... first time I saw it.
Any evidence of it in the wild in the past 8 years, like, you know, actually used once?
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#7There has been some more recent work on this lately:
https://www.dfrws.org/2016eu/proceedings/DFRWS-EU-2016-7.pdf
Essentially, with newer RAM (DDR3), the location things end up on the physical chip is scrambled to improve reliability:
> Storage of bit streams which are strongly biased towards zero or one can lead to a multitude of practical problems: Modification of data within such a biased bit stream can lead to comparatively high peak currents when bits are toggled. These current spikes cause problems in electronic systems such as stronger electromagnetic emission and decreased reliability. In contrast, when streams without DC-bias are used, the current when working with those storage semiconductors is, on average, half of the expected maximum.
So once you image the RAM you have to figure out the scrambling and undo it.
Related: https://github.com/IAIK/DRAMA
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#8That's nice first.... first time I saw it. Any evidence of it in the wild in the past 8 years, like, you know, actually used once?
Back in highschool, me and a couple of friends tried this attack ourselves (not going after disk encryption, just looking for strings in the memory dump).
By simply plugging in a bootable USB that we made, powercycling the computer [0], and selecting boot from USB in the BIOS we were able to get a memory dump from the computer.
By analyzing this memory dump, we were able to reconstruct the HTML of webpages that were open, and generate a list of password looking strings, which did contain several actual passwords.
I guess this isn't really in the wild, as it was one of our own laptops, but their was nothing stopping us from doing it on school computers to hack into other people's accounts if we wanted to; and, the person whose computer we used did end up changing her passwords.
More importantly, if a couple of highschoolers could turn this idea into a usable exploit, I would be amazed if this was never done for actual attacks.
[0] Most of the time it worked if we manually powered the computer down then up, but it worked consistently when we rebooted from within the OS.
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#9The problem here was already known before the publication of the paper even though the paper was still a clever attack. Most of security research, including high-assurance software, was largely ignoring attacks on hardware. There was a subfield growing that didn't trust the RAM, disk, peripherals, etc. These designs drew a boundary at the ASIC or SOC level where anything tampering outside was protected with crypto, PUF's, etc. The first I saw was Aegis:
https://people.csail.mit.edu/devadas/pubs/aegis-istr-august6...
Joshua Edmison's dissertation lists a number of others along with his own, interesting scheme:
https://theses.lib.vt.edu/theses/available/etd-10112006-2048...
Nobody has learned anything different since for the fundamentals. The fundamentals are still to use authenticated crypto of some sort on RAM to detect attacks there to fail safe at worst. Also, use special IO/MMU's, SOC mechanisms, and software protected by them to handle stuff on disks. Stopping cold boot attack is straight-forward on such architectures that don't trust RAM in the first place.
From there, we move into cat and mouse game of SOC attack and defense. Most of those require physical possession for more than a few minutes, though, with often destruction of the chip as a result. So, this is a significant step forward in security vs just snatching the RAM out of the system.
Re: Cryogenically frozen RAM bypasses disk encryption methods (2008)
#10There has been some more recent work on this lately: https://www.dfrws.org/2016eu/proceedings/DFRWS-EU-2016-7.pdf Essentially, with newer RAM (DDR3), the location things end up on the physical chip is scrambled to improve reliability: > Storage of bit streams which are strongly biased towards zero or one can lead to a multitude of practical problems: Modification of data within such a biased bit stream can lead to co…
I didn't know DDR3 RAM was scrambled. Thanks for the link & tip. Analog scramblers of the past were defeated in a number of simple and clever ways. Most security engineers stopped trusting scrambling as it almost always fails. A useful obfuscation at best on top of genuine encryption and authentication in RAM as in my other comment. No surprise we have another one on breakers' resumes in the RAM area.
Note: Nice shortcut link to the blog and research on it. LAVA is still on my backlog to check out although some itch in me suggests it has potential in high-assurance for testing tools, mechanisms for recovery-oriented architectures, or even teams with simulated subversion. Just haven't had time so far after work and looking at preventative stuff.