Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cold Boot Attacks

blog.f-secure.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Cold Boot Attacks

#41

Post by snaky »

pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

> We can do better, and should

It depends. Regular user in most of the world is pretty happy with $50-100 MTK-based chinaphone with 5.5" screen and 2GB of RAM - even with factory preinstalled trojans.

Re: Cold Boot Attacks

#42

Post by jarfil »

simias wrote: post #22
pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

There are so many easier way to compromise the computers of 99% of the population that this particular flaw, while interesting, doesn't really appear all that critical to me. How many people (or even companies) bother to encrypt their hard drives these days? Not many in my experience. And for those who do how hard will it be to phish the credentials using basic social engineering? If you're carrying nuclear codes the…

These attacks can be made into a pendrive you just need to plug in. On laptops that's easier than hiding some extra hardware.

Re: Cold Boot Attacks

#43

Post by snaky »

kilo_bravo_3 wrote: post #38
pjc50 wrote: post #10

Everyone's quickly jumping in to post "physical access is not secure", while over there Apple have iPhones that appear to be almost completely secure against all but the most dedicated state-level attacks (and of course compromised accounts). We can do better, and should. Without compromising the freedom to change operating system. Mind you we also need to keep pressing on security for the desktop, against ransomware…

>Without compromising the freedom to change operating system. Privacy, freedom, and security advocates seem to have opposing and wholly incompatible goals when it comes to technology. This attack is possible because the NVRAM is overwriteable. In order to mitigate this attack, you a manufacturer would need to make NVRAM non-NV or add an security device like Apple's T2 chip. Or encrypt the NVRAM and (to prevent a key…

It depends. For example, there is nothing that technically prevents adding 'add my own key' functionality to the Android phone bootloaders - that would allow user to unlock bootloader, install AOSP or any Android build of their choice, and then lock bootloader again. The fact we have no such function in bootloader is not rooted in some technical tradeoff between free and secure.

Re: Cold Boot Attacks

#44

Post by standon »

I have worked with diplomatic security and diplomatic courier service.

There is/was class of almost normal SCIF only laptops. They are always attended by a person and they must travel in diplomatic mail. Data inside the HDD is considered safe when the computer is powered off even if stolen, but any break in the custody chain and it was forbidden to open the laptop again. You just bagged it for destruction or data retrieval.

Moral of the story: controlling physical access is the key to security. Apple phone may be secure after powered down, but it may not be secure after you start using it again if it was handled by someone in between.

Re: Cold Boot Attacks

#45

Post by snaky »

ams6110 wrote: post #9
leejoramo wrote: post #5

physical access = compromised system There are things you can do to mitigate this problem, but once someone has physical access to a computer they have many pathways to gaining access to data and control.

That's true, but it's what encrypted filesystems are supposed to prevent. The lesson is that sleep/low power modes are not enough. You should be powering-off or hibernating any time the computer is not in use. Unfortunately this is against many enterprise policies for desktops, because they like to apply updates during off-hours and need the computers to be on (or at least able to wake up from sleep) to do that. For…

If their slides are correct, then disabling boot from USB is enough. But then they state

> Using a simple tool, Olle and Pasi learned how to rewrite the non-volatile memory chip that contains these settings, disable memory overwriting, and enable booting from external devices

The phrasing is confusing in that had they find a way to switch 'boot from USB' BIOS setting 'using a simple tool'.

Re: Cold Boot Attacks

#46

Post by chrisper »

hannasanarion wrote: post #13

So do y'all regularly dump liquid nitrogen on your computers after powering them off? Last I checked, cold boot attacks have to be executed within moments of a computer powering down unless it's immediately put on ice. I don't understand why we're worried about this.

When you are in sleep mode, your RAM still has power on it.

Re: Cold Boot Attacks

#47

Post by En_gr_Student »

knorker wrote: post #3

> Cold boot attacks aren’t new. They were developed by a research group back in 2008 Older than that. E.g. Pettersson's talk at CCCamp 2007.

I'd be surprised if some analog of this didn't come out in the 80's. The fundamentals were all there, even arpanet.

Re: Cold Boot Attacks

#48

Post by mannykannot »

new_age_garbage wrote: post #8

Leaving the computer on is a cold boot attack now?

At first, I could not figure out why sleep mode was an issue, but I think the point is that a cold boot attack has to be performed within minutes of the shutdown, and it has to be a 'hard' (just cut the power) type of shutdown, not an orderly shutdown where the OS stops what's running and then instructs the hardware to shut down. An attacker who gets his hands on a computer in sleep mode is in a position to force a hard shutdown and immediate cold boot when he is ready.
Post reply on HN