Show HN: Simple demo of a cold boot attack using a Raspberry Pi
1–10 of 40 posts
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#2I'd never even heard of cold boot attacks. Is there any prevention of this?
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#3I'd never even heard of cold boot attacks. Is there any prevention of this?
I believe both recent Intel and AMD processors enable you to encrypt memory, such as Intel Total Memory Encryption.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#4I'd never even heard of cold boot attacks. Is there any prevention of this?
Yes, control physical access to the hardware. You can also achieve some mitigation by using encrypted ram.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#5I'd never even heard of cold boot attacks. Is there any prevention of this?
I believe both recent Intel and AMD processors enable you to encrypt memory, such as Intel Total Memory Encryption.
That is correct, AMD Zen4 (Ryzen 7000) supports transparent full memory encryption. It also supports more granular memory encryption, for example to prevent the host accessing VM guest memory.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#6It is important to note they could access an image in the memory up to 0.75 seconds after cutting power, but after 1.0 seconds everything had completely decayed. This sounds less like a "cold boot" attack and more like the residual power is still flowing on the substrate for 0.75 seconds.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#7It is important to note they could access an image in the memory up to 0.75 seconds after cutting power, but after 1.0 seconds everything had completely decayed. This sounds less like a "cold boot" attack and more like the residual power is still flowing on the substrate for 0.75 seconds.
I wasn't able to automate the use of the freeze spray alas, but I believe that did let me access data after more significant durations.
With the freeze spray I did also manage to unplug the power cable completely and switch SD cards manually.
Edit: In "Cold Boot Attacks are Still Hot: Security Analysis of Memory Scramblers in Modern Processors" they say "To assess the feasibility of cold boot attacks on today’s denser and smaller components, we measured the retention time of five DDR3 and two DDR4 modules from various manufacturers. At normal operating temperatures, a significant fraction of the data is lost within 3 seconds of losing power."
The Pi 4 I used makes use of DDR4 from what I recall.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#8I'd never even heard of cold boot attacks. Is there any prevention of this?
* Hardware memory encryption / bus encryption. If implemented correctly, keys never touch RAM and will be discarded instantly across any power disruption.
* Control physical access: don’t allow an attacker access to the DRAM chips.
* Control logical access: use trusted boot systems which don’t allow an attacker to dump arbitrary memory, combined with physical access control so they can’t directly address memory externally.
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#9It is important to note they could access an image in the memory up to 0.75 seconds after cutting power, but after 1.0 seconds everything had completely decayed. This sounds less like a "cold boot" attack and more like the residual power is still flowing on the substrate for 0.75 seconds.
0.75 seconds without cooling.
I would not expect "residual power" to last for 0.75 seconds. Even if it did, RAM has to actively be refreshed by the memory controller. (DDR self-refresh is only enabled during sleep and I dunno if the Pi even supports that)
Re: Show HN: Simple demo of a cold boot attack using a Raspberry Pi
#10It would be interesting to do this with different delays to see how the noise level increases as the delay increases, then once you have a bunch of images recovered, make an animation of the image getting more and more noisy as the time increases, would also be interesting to compare the results for different ambient temperatures, how much more feasable would this be during January in Norway vs August in Texas?