6 ms·
You want to enable this if your concerned about forensic attacks. A simple example would be someone has physical access to your device. They're able to power it
by bhawks 4y ago
You want to enable this if your concerned about forensic attacks. A simple example would be someone has physical access to your device. They're able to power it down, and boot it with their own custom kernel. If the memory has not been eagerly zeroed they may be able to extract from RAM sensitive data.
This flag puts an additional obstacle in the attacker's path. If you have private key material protecting valuable property, you definitely want to throw up as many roadblocks as possible.
- Wowfunhappy 4y agoHow is the attacker powering down the device while retaining the contents of its RAM?
- Gracana 4y agoData fades slowly from DRAM, especially if you freeze it first.
- l33t233372 4y agoPerhaps by using a can of compressed air[0]. [0] https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf https://www.usenix.org/legacy/event/sec08/tech/full_papers/h...
- soulofmischief 4y agoIf your PC is connected to a power strip, it's my understanding that law enforcement can attach a live male-to-male power cable to the power strip and then remove the power strip from the wall while still powering the computer. That, and yeah freezing ram.
- ghostpepper 4y agoSo technically that's removing power, not "powering it down". I guess you'd then warm-boot with your own kernel and hope that the contents of RAM are mostly untouched?
- l33t233372 4y agoI don’t understand why this would help prevent cold boot attacks. Wouldn’t the memory need to bee free’d first for this to have any effect?
- ender341341 4y agothe idea is that well written software would release memory as soon as possible so with it enabled you'd have the secret in memory for as little time as possible. Though in my mind well written software should be zeroing the memory out before freeing if it held sensitive data.
- jamesfinlayson 4y agoYes I thought that was common practice - I remember reading patch notes for something years ago where the program had been updated to always zero the password buffer after checking that it matches (I think in some cases it was kept around for a bit).
- bhawks 4y agoFrom a defense in depth perspective you definitely want the implementation to be robust (zero the memory after reading). However you should also consider: 1) abnormal program termination due to signals, memory pressure/oom killer, aborts in other threads serving different requests, and so on. These events could race with the memory zeroing. 2) bugs in the implementation where memory isn't zeroed in all paths 3) interactions between compiling, standard libraries, language runtimes and optimization passes causing memory zeroing to be skipped. All these cases have happened time and time again in the wild. Hence having additional safety nets is useful. These patches were endorsed by folks working on chromeos and Android security. I would suppose that they want them to put additional safeguards behind full disk encryption keys and may also be concerned with quality of implementation issues in 3rd party or vendor blobs.
- bhawks 4y agoYes it would - either through the free syscall or a process exit. This is a defense in depth strategy and not 100% perfect. If you yanked the power cord and a long lived process had sensitive data in memory you're still vulnerable. But if you had a clean power down or very short lifetimes of sensitive data being active in RAM it would afford you additional security.