Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cold Boot Attacks

blog.f-secure.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Cold Boot Attacks

#21

Post by hyperpape »

hannasanarion wrote: post #14
pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

IPhones are probably vulnerable to cold boot too. It's just that cold boot attacks are absurdly difficult to execute. They only work if you already have physical access to an unlocked device before it powers down. If you shut off your machine and wait two seconds before walking away, you can never be cold-booted

Are you sure/can you provide sources? Given the substantial efforts law enforcement has been taking to get access to suspects' iPhones, this doesn't seem right.

Re: Cold Boot Attacks

#22

Post by simias »

pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

There are so many easier way to compromise the computers of 99% of the population that this particular flaw, while interesting, doesn't really appear all that critical to me. How many people (or even companies) bother to encrypt their hard drives these days? Not many in my experience. And for those who do how hard will it be to phish the credentials using basic social engineering?

If you're carrying nuclear codes then yeah, you should be worried about these attacks. If you're security officer for a small company then you probably have a long list of things to worry about before you have to consider cold boot vulnerabilities.

Furthermore if you're worried about an attacker having physical access to your computer what about simply installing a keylogger or a device that broadcasts your display for instance? That seems massively easier and faster to pull off than the attacks described here.

Re: Cold Boot Attacks

#23

Post by jo909 »

acura wrote: post #6

Cold boot, you keep using this word and you don't know what it means. Or is it me who have a screwed definiton of cold boot?

As defined in the article: "when a computer is reset without following proper procedures (what’s known as a cold/hard reboot)"

Even if you disagree, "cold boot attack" is the established name for the actual attack, the new aspect presented here is how to circumvent a certain firmware protection that would overwrite the memory on a cold boot to prevent that attack.

If you would give your definition we could see if it is right, too.

Re: Cold Boot Attacks

#24

Post by rasz »

hannasanarion wrote: post #14
pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

IPhones are probably vulnerable to cold boot too. It's just that cold boot attacks are absurdly difficult to execute. They only work if you already have physical access to an unlocked device before it powers down. If you shut off your machine and wait two seconds before walking away, you can never be cold-booted

kinda hard when your ram is soldered on top of BGA cpu

Re: Cold Boot Attacks

#25

Post by detaro »

jarfil wrote: post #17

So when are we getting encrypted RAM? With all the talk I hear about "cache being the new RAM", since it's so much faster, particularly the L1, it sounds like it would make sense to have some transparent encryption going on. A random key generated at power on, then kept inside the CPU, and instantly lost at power off, would be enough to secure the contents of DIMMs against attacks like this.

I believe some AMD CPUs already support it, and there's some mention of it in Linux Kernel docs (https://github.com/torvalds/linux/blob/master/Documentation/...), but I'm not sure if it's actually used in practice or not.

Re: Cold Boot Attacks

#26

Post by albntomat0 »

hyperpape wrote: post #21
hannasanarion wrote: post #14

Earlier quoted context omitted.

IPhones are probably vulnerable to cold boot too. It's just that cold boot attacks are absurdly difficult to execute. They only work if you already have physical access to an unlocked device before it powers down. If you shut off your machine and wait two seconds before walking away, you can never be cold-booted

Are you sure/can you provide sources? Given the substantial efforts law enforcement has been taking to get access to suspects' iPhones, this doesn't seem right.

The commenter above specifically says powered on, unlocked. If the phone is locked or powered off, things are much harder.

Re: Cold Boot Attacks

#27

Post by simias »

jarfil wrote: post #17

So when are we getting encrypted RAM? With all the talk I hear about "cache being the new RAM", since it's so much faster, particularly the L1, it sounds like it would make sense to have some transparent encryption going on. A random key generated at power on, then kept inside the CPU, and instantly lost at power off, would be enough to secure the contents of DIMMs against attacks like this.

Somebody could put a hardware keylogger on your keyboard interface instead. Or de-solder your CPU and replace it with a backdoored version.

Re: Cold Boot Attacks

#29

Post by lazyjones »

bardworx wrote: post #2

From a security standpoint, isn’t there a common understanding that if an attacker gains physical access to your computer, you already lost? As a side note, there are so many vulnerabilities constantly coming out that I’ve almost became desensitized. I’m sure that’s not a good thing but it’s almost like “when” not “if” someone will just steal my data. Not sure if anyone agrees or I’m just a one-off...

> isn’t there a common understanding that if an attacker gains physical access to your computer, you already lost?

I don‘t think so. It would mean that securing information in the workplace is nearly impossible and colocation hosting security intrusion boils down to picking a physical lock (of your rack).

Re: Cold Boot Attacks

#30

Post by cesarb »

jarfil wrote: post #17

So when are we getting encrypted RAM? With all the talk I hear about "cache being the new RAM", since it's so much faster, particularly the L1, it sounds like it would make sense to have some transparent encryption going on. A random key generated at power on, then kept inside the CPU, and instantly lost at power off, would be enough to secure the contents of DIMMs against attacks like this.

It already exists on AMD: https://en.wikichip.org/wiki/x86/sme
Post reply on HN