5 ms·
> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you
by nicolas_t 10y ago
> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off.
I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no?
For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with a thief accessing my customer's source code.
- teddyh 10y agoEven though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the (https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack). The method from the article only removes the need to physically remove and cool the memory chips.
- gommm 10y agoOk, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?
- mikeash 10y agoApple wants the computer to be able to wake up on its own in order to fetch new emails and such. Just a few minutes ago, I used Screen Sharing to connect to my sleeping MacBook from another room to check for updates based on this article's recommendation. Quite convenient, but it does imply that the OS keeps the keys around. I'd bet that if you turn all that stuff off, they keys are scrubbed. That could be a good compromise instead of turning the computer completely off all the time.
- Matt8109 10y agoMy understanding is that it is configurable on macOS by enabling destroyfvkeyonstandby. https://derflounder.wordpress.com/2014/02/12/power-nap-power-management-settings-and-filevault-2/ https://derflounder.wordpress.com/2014/02/12/power-nap-power...
- raverbashing 10y agoSleep does not shuts down ram.
- renaudg 10y agoThere are no memory chips to remove on recent Macs, making this attack much harder if not impossible to perform.
- teddyh 10y agoMacs still have memory chips, even if they are not removable. This can be attacked by using specialized hardware which you press onto the RAM chips’ connectors. The inability to remove RAM is not meant as a security feature, and therefore gives no significant protection against a motivated attacker with specialized hardware.
- tptacek 10y agoAssume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a targeted attacker, like the FBI when they took down Ross Ulbricht (who FDE'd his laptop), the attacker will simply wait until the laptop is unlocked.
- 6DM 10y agoI was curious about that, so I looked it up. Pretty interesting stuff. [0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Road employee "cirrus" — initiated a chat with Ulbricht, requesting that he log in to Silk Road's back end to fix a technical problem. As soon as Der-Yeghiayan could confirm that Ulbricht was logged into the site, FBI agents entered the library. Two plainclothes FBI agents, one male and one female, walked up behind Ulbricht and began arguing loudly. This staged lovers' tiff caught Ulbricht's attention long enough to distract him from his laptop. As soon as Ulbricht looked up, the male agent reached down and slid the computer over to his female colleague, who quickly snatched it up and handed it over to Kiernan for further investigation." [0] http://www.businessinsider.com/ross-ulbricht-will-be-sentenced-soon--heres-how-he-was-arrested-2015-5 http://www.businessinsider.com/ross-ulbricht-will-be-sentenc...
- Sephr 10y ago> Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? The Windows lockscreen has had a law enforcement backdoor since at least Windows XP. This effectively makes FDE worthless on Windows if you only put your computer to sleep instead of a full shutdown.