Cold boot disk encryption attack is shockingly effective

It's an old adage that no security measure is worth anything if an attacker has physical access to the machine, but things like heavy-duty disk encryption are supposed to at least slow things down. Sadly, that may not actually be the case, as a group of Princeton researchers has just published a paper detailing an exploit that requires little more than a spray duster and a screwdriver. Since the encryption key for systems like BitLocker and FileVault lives in RAM, all an attacker has to do to get it is cool the RAM modules with the air duster held upside down, yank the DIMM, and insert it into another machine, where it can then be read to access the key. Of course, this assumes that you've already typed in your password, but check the video after the break to see how long bits in RAM stay written -- even if you've turned off your computer, there's a chance the key can still be read. Looks like there's an actual benefit to MacBook Air's soldered-in RAM after all, eh?

[Ellianth @ Feb 21st 2008 6:24PM]

All that work just to get at someone's porn collection?

[Mark @ Feb 21st 2008 6:46PM]

A man's porn is his life.

[Tim @ Feb 21st 2008 7:11PM]

You can get into a lot of trouble if someone steals his pr0n:
http://en.wikipedia.org/wiki/Edison_Chen_photo_scandal

[Tim @ Feb 23rd 2008 1:02AM]

You can get into a lot of trouble if someone steals his pr0n:
http://en.wikipedia.org/wiki/Edison_Chen_photo_scandal

[Anton @ Feb 21st 2008 7:26PM]

PORN FTW!

[mr friggles @ Feb 21st 2008 9:24PM]

All that article just to fling more CRapple at us.Engaaaaaagdet does it again.

Thanks for reminding me why I hate CRapple. They pay blogs to hawk trash like this.

[Jake @ Feb 21st 2008 9:54PM]

OH, YOU ATTACHED CR TO APPLE WHICH MAKES THE WORD CRAP! THAT'S CLEVER, YOU'RE CLEVER.

[Josh @ Feb 24th 2008 12:19AM]

lol

[Timerider @ Feb 25th 2008 6:59PM]

lol, go Jake, best...comment...ever

Seriously, if there's one mention of anything Apple, why do people start going "OH MA GAWD, UR APLE FANBOIS!!11!", but if there's mention of anything Microsoft no one goes nuts. Hmmm...

[Jizzle @ Feb 21st 2008 6:25PM]

wow, there's a benifit to getting a macbook air. who knew?

but seriously, that mention was unnecessary. stop being such apple supporters, engadget.

[Miles @ Feb 21st 2008 6:56PM]

It's little quips like that that make many people love Engadget.

[Pismodude @ Feb 21st 2008 6:59PM]

Oh, sure, if they so much as say the word 'MacBook' it automatically = Apple support? Come on, we all know that was a clever way to get in a hidden dis. ;-)

(^.^)
-

[Eddie @ Feb 21st 2008 7:00PM]

Blah blah blah blah...

Just shut the f*** up. If you don't like what you read, just go somewhere else. No one is forcing you to read news here. If you don't like the news, and don't like Mac (which is fine with me) you should leave the rest of us with the Engadget we like.

I'm tired of you whiners.

Thanks, good bye.

[JD @ Feb 21st 2008 7:11PM]

Well, if you're hardcore enough to want to get that out of someone's RAM, chances are you could de-solder the ram to get it. Come on. Lol.

[Aguiluz @ Feb 21st 2008 7:49PM]

@ JD

And by the time you have de-soldered the chips from the Apple, you have to re-solder them back to a compatible circuit board or device. By the time you have done that - assuming you did - the chips should have lost their memos or could have been zapped by ESD or even fried by the heat of the soldering tool itself.

If you want a secure laptop, use a remote-triggered C4 charge and pack the explosives near the hard drive. When the laptop gets stolen, push the button. KA-BOOM! Bye bye data. And Laptop. And Theif.

[Natedog @ Feb 21st 2008 8:10PM]

My Asus W7S has one stick of RAM soldered in... but that's certainly not a feature. It's quite the opposite, actually... It's pretty annoying.

[kureshii @ Feb 21st 2008 8:25PM]

Odd... when they mentioned soldered RAM I was thinking new-generation Asus Eees instead =P

[someyungai @ Feb 21st 2008 9:51PM]

Actually you don't have to take out the RAM, you can theoretically boot off of a thumb drive and grab the contents of RAM.

[patsy @ Feb 21st 2008 10:03PM]

@Eddie: Wow, the "if you're not with us, you're against us" attitude incarnate. It's alive! Guess what, part of living in the free world is the right of dissent. I can actually frequent this board, disagree with everything you say just because and even call yo' mama fat, and there's not much you can do about it except do some whining of your own. Boohoo!

[Aguiluz @ Feb 21st 2008 10:11PM]

@ someyungai

Boot off a thumb drive and nab the contents of the RAM? How? If I am right, if you boot from a thumb drive it loads to the RAM, destroying anything in it!

[Holo @ Feb 22nd 2008 3:35AM]

What happens if I have the contents of my RAM encrypted? Is the key then secure?

[DagMX @ Feb 22nd 2008 3:50AM]

@holo
I doubt it's possible to effectively encrypt your RAM. The decryption has to happen somewhere and the keys have to be held somewhere as well. I suppose if you had very little ram and the keys could be stored in the processor cache. or you could keep the keys section of the ram encrypted.

@aguilez
it's theoretically possible if the program on the thumb drive is small enough to only overwrite a tiny part of the ram. but then its hit and miss

[Juaquin @ Feb 22nd 2008 4:24AM]

Where would Engadget be if they couldn't work Apple into every post?

[Jack @ Feb 21st 2008 6:25PM]

"Looks like there's an actual benefit to MacBook Air's soldered-in RAM after all, eh?"

No, Not really

[Chuck @ Feb 21st 2008 6:58PM]

I'd love to see Engadget's response if it was Dell or Microsoft that thought to solder the memory.

[Rollins @ Feb 21st 2008 7:32PM]

Microsoft soldering the memory just doesn't make sense, unless you're talking about on a game console or a Zune, since they don't make computers.

And if Dell did it, I doubt there'd be a fuss.

[newgalactic @ Feb 22nd 2008 5:35PM]

Actually, I'd be just as disgusted with a Dell that doesn't allow RAM upgrades. Restrictive hardware is restrictive hardware. Though, the Air is almost the size of a palm top. So I guess that a little leeway is justified when Apple deviates from hardware expectations.

[Prokanda @ Feb 21st 2008 10:26PM]

I know, right? because.... besides maybe graphics done for some artistic job, what would someone with an Apple actually need to protect? Garage Band files? Dock icons? Warhol-ish-filter shots from the integrated webcam?

and really, what macbook air owner is going to do graphics? it's a fashion statement for people that check their e-mail and want to play the built in 3D chess (if it can even run that properly).

haha... soldiered in ram.

[MrGuru @ Feb 22nd 2008 5:45AM]

Vista Solders my PC memory everyday.....

[16 Coming through Roofless @ Feb 21st 2008 6:28PM]

I knew Apple wouldn't let me down.

[ethana2 @ Feb 21st 2008 7:51PM]

The fact that Apple kept OSX out of the world of competitive operating systems by locking it to their hardware means they've let each and every one of us down.

...Google + Canonical FTW!

[Liam @ Feb 21st 2008 6:30PM]

Clever hackers. Really, stuff like this is a bit cool.

[Jeff @ Feb 21st 2008 7:09PM]

wah waaaahh.

Pun *definitely* intended.

[Hung @ Feb 21st 2008 8:52PM]

I love when they post How-To videos like this. It's so well thought out, too. Each step is slowly described and then executed. I'll be sure to try these tips the next time I want to obtain some direly important data.

P.S. No, my reply is not relevant to Liam's comment. Yes, I am riding on Liam's coattails. Forgive my ways of the whore.

[Ray @ Feb 21st 2008 6:31PM]

Creepy. i have one of those duster cans right next to me as of this writing.

[wootman @ Feb 21st 2008 7:31PM]

same.
i feel 1337er.

[cryption haxxor @ Feb 21st 2008 11:19PM]

I got two cans by my side. That makes me über 1337er.

[meist3r @ Feb 21st 2008 6:33PM]

Steal this idea:
Put a capacitor on the RAM module that holds enough power to write a pass of random data onto the memory once power is cut. Ensure it works in extreme cold ;p

[jonnydangers @ Feb 21st 2008 6:35PM]

im no apple fanboy myself, far from it
but its still enjoyable watching you guys constantly hound engadget for every little apple mention
chillll out

[bartoron @ Feb 21st 2008 6:37PM]

Excuse me for being an idiot, but what's the air duster for?

[meist3r @ Feb 21st 2008 6:40PM]

Usually those can are filled with a liquid gas to push out the can's contents, if you turn the can upside down the stuff flows to the nozzle (because it's the heaviest of the can's contents) and the stuff is pretty cold when it reacts with the oxygen in the environment. Ice spray works like that. It's an easy way to cool stuff down quickly. So done my geek duty for today.

[Will @ Feb 21st 2008 6:41PM]

Cooling down the RAM

[DrunkMonkey @ Feb 21st 2008 11:35PM]

The stuff in the can doesn't "react" with oxygen. It just evaporates quickly.

Sorry to nit-pick, buy I can't let someone be wrong on the internet.

[meist3r @ Feb 22nd 2008 7:48AM]

"evaporates quickly" thus removing heat from the sourrounding environment to power it's own transfer from one state to another liquid -> gas. To me that's a reaction, well not a classic oxygen reaction maybe I used the wrong term.

xkcd ftw!

[jrgrade @ Feb 22nd 2008 9:39AM]

It's not a reaction, it's a change in atmospheric pressure. I works just like any refrigerator or chiller. The gas used in the "can of air" is pumped into the can under pressure which changes it's state from a gas into a liquid. This process can be compared to the the condenser side of an air conditioner or chiller. This part gives off heat energy. When the can is turned upside down and the trigger pressed, the liquid escapes the can faster than intended and instead of changing states from a liquid into a gas in a controlled manner, (blast of air) it saturates the area briefly with the liquid. Almost instantly the liquid evaporates, which is the change of state from liquid to gas. This evaporation process needs heat energy to complete, so it "borrows" it from anywhere. In this demonstration, from the RAM chips. Again compared to the evaporator of an air conditioner.

No reactions, just changes of states and transfers of energy. Anyway, sorry to hijack this thread, just wanted to clarify.

[David Vogt @ Feb 21st 2008 6:38PM]

Oh man, yet another advantage that Mac has. *rolls eyes* was that REALLY necessary?

[Nick @ Feb 21st 2008 6:43PM]

was repeating what other people already said REALLY necessary?

[David Vogt @ Feb 21st 2008 6:48PM]

You're right Nick, I also shouldn't vote because other people already voted for the candidate.

[Zorque @ Feb 21st 2008 7:04PM]

No, but you shouldn't fill up the page with redundancies that nobody wants to read.

[David Vogt @ Feb 21st 2008 7:13PM]

And Engadget should stop posting Apple references in EVERY SINGLE POST that nobody wants to read. In fact, they should mark all the Apple references in green so that I know to skip those sentences. There's a revolutionary idea!