4 ms·

This is relevant to the hack you can do when trying to retrieve secrets from ram from a live computer: pull the dimms out, blow some cold air on them and then s

by gleenn 8y ago

This is relevant to the hack you can do when trying to retrieve secrets from ram from a live computer: pull the dimms out, blow some cold air on them and then stick them in another computer that's ready to dump the contents. I've heard its a good attack against full-drive encryption because the keys are sitting in plaintext in RAM. I've also heard it works for up to minutes after the computer has been turned off.

voxadam 8y ago
What you're referring to is called a "cold boot attack".
- Scoundreller 8y ago
  It would be cool if computers were designed to shutdown and clear RAM if they detected rapid cooling. Ideally this monitoring process would continue during hibernation. I guess there wouldn’t be anything possible if power was completely removed, but at least then an attacker is dealing with only being able to begin cooling after shutdown and cells start being lost. The system should also balk if restarted within a short period of time, but a rapid temperature reduction. This would help prevent non-removal attacks (Eg: rebooting with a minimal OS to pull whatever one could -> great for MACs).
  - celeritascelery 8y ago
    Generally you pull the ram before you cool it, so this wouldn’t do much.
    - mirimir 8y ago
      Paranoid folk crazy glue their RAM, and embed in alumina-filled epoxy (which conducts heat well).
      - Phlarp 8y ago
        For all the hate the modern macbook design gets, this is one positive of having soldered components.
  - jiveturkey 8y ago
    i was about to poo poo this idea but yeah, for non-removal this would be good
- BeeOnRope 8y ago
  Cold boot attack usually refers to reading the DIMMs from the machine they are installed in, by rebooting it. The GP described a slightly different thing: physically removing the RAM modules and dumping their contents with a different host.
deleted 8y ago
[deleted]
nigwil_ 8y ago
There is progress towards encrypting memory, although there remains limitations, complexity and performance penalty challenges: https://lwn.net/Articles/752683/ https://lwn.net/Articles/752683/
- seppel 8y ago
  Gaming consoles have encrypted RAM for more than a decade.
  - delroth 8y ago
    You say "gaming consoles", but really I think I've only seen it in the Xbox 360. Was it deployed anywhere else that I missed?
    - dcow 8y ago
      Didn’t the Wii do something similar? Also it’s not just “gaming consoles”: https://www.cl.cam.ac.uk/~rja14/tamper.html https://www.cl.cam.ac.uk/~rja14/tamper.html
      - dfox 8y ago
        Wii does not do RAM encryption (which is somewhat understandable given the fact that the RAM is mostly embedded 1T-SRAM that is not directly accessible anyway). As far as I know the only two systems that use cryptographically meaningful memory encryption are Xbox 360 and zArchitecture mainframes. Various secure crypto processors usually have some support for external "encrypted" SRAM, but as this typically involves microcontroller platforms and byte/word-wide accesses to said memory the implementation in the best case boils down to CTR mode (usually of some secret semi-proprietary algorithm of questionable cryptographic qualities) without IV or any authentication.
    - dijit 8y ago
      PS4 and XB One both have "secret" memory areas which I think are encrypted. We use these features to store small amounts of very sensitive data, key material for example.

by gleenn 8y ago

voxadam 8y ago

What you're referring to is called a "cold boot attack".

Scoundreller 8y ago
It would be cool if computers were designed to shutdown and clear RAM if they detected rapid cooling. Ideally this monitoring process would continue during hibernation. I guess there wouldn’t be anything possible if power was completely removed, but at least then an attacker is dealing with only being able to begin cooling after shutdown and cells start being lost. The system should also balk if restarted within a short period of time, but a rapid temperature reduction. This would help prevent non-removal attacks (Eg: rebooting with a minimal OS to pull whatever one could -> great for MACs).
- celeritascelery 8y ago
  Generally you pull the ram before you cool it, so this wouldn’t do much.
  - mirimir 8y ago
    Paranoid folk crazy glue their RAM, and embed in alumina-filled epoxy (which conducts heat well).
    - Phlarp 8y ago
      For all the hate the modern macbook design gets, this is one positive of having soldered components.
- jiveturkey 8y ago
  i was about to poo poo this idea but yeah, for non-removal this would be good
BeeOnRope 8y ago
Cold boot attack usually refers to reading the DIMMs from the machine they are installed in, by rebooting it. The GP described a slightly different thing: physically removing the RAM modules and dumping their contents with a different host.

deleted 8y ago

[deleted]

nigwil_ 8y ago

There is progress towards encrypting memory, although there remains limitations, complexity and performance penalty challenges: https://lwn.net/Articles/752683/ https://lwn.net/Articles/752683/

seppel 8y ago
Gaming consoles have encrypted RAM for more than a decade.
- delroth 8y ago
  You say "gaming consoles", but really I think I've only seen it in the Xbox 360. Was it deployed anywhere else that I missed?
  - dcow 8y ago
    Didn’t the Wii do something similar? Also it’s not just “gaming consoles”: https://www.cl.cam.ac.uk/~rja14/tamper.html https://www.cl.cam.ac.uk/~rja14/tamper.html
    - dfox 8y ago
      Wii does not do RAM encryption (which is somewhat understandable given the fact that the RAM is mostly embedded 1T-SRAM that is not directly accessible anyway). As far as I know the only two systems that use cryptographically meaningful memory encryption are Xbox 360 and zArchitecture mainframes. Various secure crypto processors usually have some support for external "encrypted" SRAM, but as this typically involves microcontroller platforms and byte/word-wide accesses to said memory the implementation in the best case boils down to CTR mode (usually of some secret semi-proprietary algorithm of questionable cryptographic qualities) without IV or any authentication.
  - dijit 8y ago
    PS4 and XB One both have "secret" memory areas which I think are encrypted. We use these features to store small amounts of very sensitive data, key material for example.