7 ms·
Robot can rip the data out of RAM chips
- bogantech 3y agoAnyone know how the memory chips are removed from the target board? They can't be desoldering them if it's a cryogenic process
- aa-jv 3y agoGet things cold enough and you can pop off most BGA-based packages from the boards ..
- bri3d 3y agoIt’s in the article, they’re desoldered and reballed like normal and then socketed: “What makes the attack possible, he said, is something called a conductive elastomer IC test socket.” The cryogenic pick and place robot then moves the now-socketed chip from the board to the test fixture at runtime.
- adhesive_wombat 3y agoThe elastomeric sockets are really cool. They're like 2D versions of those zebra connectors for LCDs: you just press them down and the land pattern is replicated on the other side. Furthermore, they work into the GHz range, which you need, say, for messing with modern DDR RAM standards. https://www.ironwoodelectronics.com/products/ghz-elastomer-sockets/ https://www.ironwoodelectronics.com/products/ghz-elastomer-s...
- imtringued 3y agoThis is ridiculous. You need to steal the hardware, analyse the specific model, build a machine for it and manipulate it and then bring it back to the original user and then steal it again after he has entered his credentials and then you have to use a dedicated machine to perform the actual attack and you only have one attempt.
- ilyt 3y agoIf it is a laptop, yeah, not super practical, but there are plenty of devices secured by encrypted firmware that gets decoded on boot and stored in memory
- wongarsu 3y agoYeah, way more practical for servers in a datacenter than for a random laptop you confiscated. Though tooling for each of the most recent iPhones might also be worth it
- bri3d 3y agoWrong use case. It's a reverse engineering tool to extract firmware, secrets, and code to develop and exploit, not an exploit in and of itself. This would be a horrendous way to recover user credentials but it's a great way to recover encrypted firmware, session/authorization/authentication keys derived in "Secure World" on embedded systems, and static runtime secrets decrypted using a derived key (key vaults, etc.).
- drones 3y agoI thought ram chips had volatile memory. As soon as it loses power it effectively wipes all data, no? How does the physical removal process preserve the contents? Are modern RAM chips not volatile anymore?
- alufers 3y agoThey literally freeze them with liquid nitrogen, which makes them preserve their state.
- drones 3y agoHuh, TIL: https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
- amelius 3y agoA RAM module should keep some power in the module to erase itself when the external power is lost. Or when suddenly the temperature drops by a lot.
- speedgoose 3y agoAn alternative is to encrypt the data. AMD calls that SME for example. https://www.amd.com/en/developer/sev.html https://www.amd.com/en/developer/sev.html
- gabeio 3y ago(quote from link) > The key is generated by the AMD Secure Processor at boot. Wouldn't this key _also_ be accessible? Maybe not on the same _chip_ but it's still at some level in a memory chip somewhere, they would just need to find it?
- sneak 3y agoIt's stored inside the CPU of the secure element, in something like a register. Otherwise both the key and the ciphertext would be in the ram and the protection would be pointless.
- chongli 3y agoWhy not build a thermocouple into the RAM package and program the operating system to overwrite memory with random data on detection of a sudden temperature drop?
- deleted 3y ago[deleted]
- adhesive_wombat 3y agoYou can also pot the PCB, and/or enclose it in a physically secure enclave where if it detects ambient light, actuation of a switch, breach of a conductive trace embedded in the case around it, etc, it wipes the RAM and, depending on your paranoia levels, blows the hardware up. Some key management Hardware Security Modules do this. Also this: https://en.wikipedia.org/wiki/Harvey's_Resort_Hotel_bombing https://en.wikipedia.org/wiki/Harvey's_Resort_Hotel_bombing The designer could probably have made more cash patenting his systems!
- bri3d 3y agoUsing the OS to do this is unlikely to be effective; the attacker with this access could usually halt the CPU before they remove RAM. As in the article, the best mitigation against this kind of attack is memory encryption, either in hardware or software (although in software, you have to figure out how to keep your keys out of RAM). There are security oriented ICs of various types (flash, RAM, secure element) which do clear data with a tripwire in a lot of ways; some even have onboard current storage of some kind which allows them to clear all data as a "dying breath" when the package is tampered with. But COTS DDR RAM needs to be cheap and doesn't usually have this kind of threat model.
- josephg 3y ago> although in software, you have to figure out how to keep your keys out of RAM I think you can do this with modern “trusted computing” modules.
- the8472 3y agoThat's still a reactive defense. A safer approach is to encrypt the data and keep the keys in the CPU, which is what TME (intel) and SME (amd) do. The downside is some added latency, power consumption and die area.
- tpmx 3y agoPaper: https://wootconference.org/papers/woot23-paper3.pdf https://wootconference.org/papers/woot23-paper3.pdf
- tpmx 3y agoAnd slides: https://wootconference.org/slides/3-Cryo-Mechanical_Memory_Extraction_Against_Modern_Embedded_Systems.pdf https://wootconference.org/slides/3-Cryo-Mechanical_Memory_E...
- bsder 3y agoThank you for this! The whole thing hinges on the elastomeric sockets and I had no idea what they were talking about until you referenced the paper. Those sockets are mega cool. I need to go down the rabbit hole of those for a while.
- mabbo 3y agoMust be 25 years ago now I was chatting with a family friend, my friends dad, and he told me roughly what it was that he does: "If I have physical access to your computer, I can probably get whatever data you have off of it". It was the first time I had even heard of computer security as a concept. I don't know precisely what methods he was using back then (it was the 90s) but he was dead serious. The point he made has become more and more true over time: Whoever can touch the machine, you presume they have better access than the admin.
- remh 3y ago25 years ago it would be very unlikely for your hard drive to be encrypted. So you could just take the hard drive and read it direct ly.
- fbdab103 3y agoI do not think that holds up today. While there do still exist a wide variety of unsecured vectors, those are closing rapidly. Look at any of the closed hardware platforms (Xbox, Playstation, iPhone, TPM, etc). People with strong desires to exfiltrate data are stymied.
- iudqnolq 3y agoIt's not that simple. Everything, even secure hardware, can have bugs. https://www.washingtonpost.com/technology/2021/04/14/azimuth-san-bernardino-apple-iphone-fbi/ https://www.washingtonpost.com/technology/2021/04/14/azimuth...
- HWR_14 3y agoWhile people with strong desires are stymied, I wouldn't trust any of those systems against a motivated nation-state.
- fbdab103 3y agoWhile nothing is perfect, newer security models do have strong theoretical security guarantees (barring implementation problems). Significantly strong enough that it will certainly stop random guy-who-is-good-with-computers. Which is the actual threat model for 99.99% of the population. Nation states have significantly more and different attack options available (eg unencrypted cloud backups, rubber stamped warrants, and old-fashioned rubber-hose attacks).
- jhalderm 3y agoIncredibly "cool"! The physical-chip-swapping version of the cold-boot attack is extremely general, but it's always been very labor intensive—that's why automation like this could be a game changer. Here are some photos from our original experiments 15 years ago, to help you picture what's involved in doing these attacks manually: https://web.archive.org/web/20080225131822/http://citp.princeton.edu/memory/media/ https://web.archive.org/web/20080225131822/http://citp.princ... Needless to say, our setup (and approach to lab safety) was rather privative by today's standards: https://web.archive.org/web/20100616201843/http://citp.princeton.edu/memory-content/memory_8.jpg https://web.archive.org/web/20100616201843/http://citp.princ...
- colanderman 3y agoWhat is the advantage of this vs. some sort of "go-between" module which mirrors all RAM traffic to an external device?
- frabert 3y agoYou probably can't do that without screwing up the signal integrity
- colanderman 3y agoOnly if it's passive -- I would expect an active (buffered) solution to work fine.
- ianburrell 3y agoBecause when you pull the RAM chip to add the module, it loses its data and the system crashes. This attack is for people who just got access to a running system. I have heard about this for FBI who have running system that they can’t turn off cause then it would be encrypted. Their targets are unlikely to allow law enforcement to add monitoring to their computers. And if they had prior access, compromising the software or other hardware would be better.
- colanderman 3y agoAh the article was talking a lot about keys in the bootloader, so I was assuming this was intended to be used after a fresh boot.
- peter_d_sherman 3y agoHere's an interesting line from this article: >They also conducted a similarly successful attack on DDR3 DRAM in a CISCO IP Phone 8800 series to access the runtime ARM TrustZone memory. Generic Pattern/Idea expressed in above statement: a) IF a given CPU implements a security processor (i.e., Intel Management Engine, AMD PSP, Apple Secure Enclave, an ARM security coprocessor, etc.) then: b) IF that security processor uses a small part of physical RAM of the computer it is in for its activities, and that physical RAM, during those activities is inaccessible to programs, OS'es and Hypervisors alike, then: c) It may still be possible to get a memory dump of that protected subsection of RAM during those activities by one or more methods, including (but not limited to!) the physical freezing/robotic extraction of the RAM... I would suggest that if point-in-time RAM extraction were the desired goal (and it apparently is) -- that it might be far simpler to use an FPGA connected to appropriate RAM and have that device emulate aka proxy (via signal paths) the device's RAM from which data is to be extracted from... Also... prediction: Future RAM will be built such that it can be easily proxied/tapped/tee'd/traced/interposed by third party hardware devices... That is, future RAM interconnect signal paths will be intentionally engineered for that purpose... In future computers, CPU, memory and all devices will be modular; where all interlinking signal paths could be proxied/tapped/tee'd/traced/interposed by third party hardware devices... Think of it this way; what the original IBM-PC did for computing of the era (open the bus, open the backplane to accept 3rd party expansion cards) -- should be done between every possible set of electronic components in future PC's/computing devices...
- userbinator 3y agoA lot of the critical infrastructure embedded things that we depend on, almost none of them are addressing this kind of attack Because it's beyond impractical and to attempt to "defend" against such things is effectively fighting against the base principles of (physical) property ownership? The direction that "security" research has headed in is really disturbing.
- bick_nyers 3y agoSounds like a use case for a BIC (Bomb-In-Chip) implementation.
- jstarfish 3y agoWhy eat a murder or obstruction charge when you don't have to? Power off if the cover is opened. ESD is a bitch, right? Gotta protect against that...
- bsder 3y agoNot at all. If I am forced to surrender my phone at a border crossing, for example, I would like to know that the fact I powered it off is sufficient to deter these kinds of attacks. It's relatively easy to thwart this attack--the CPU only sends encrypted data to external memory chips. The devil is in the implementation--encryption adds latency to memory access.
- ars 3y agoYou have neglected the man with a big gun security hole. Do I need to link to the XKCD comic?
- 0cf8612b2e1e 3y agoEnormous difference between widespread dragnet data collection and targeted wrench attacks. Most people are not actual suspects worth any scrutiny. It is only when grabbing and storing the data becomes cheap that it becomes routine action (eg duplicate all phones at the border).
- coppsilgold 3y agoAMD Ryzen Pro CPUs have a memory encryption feature (SME): <https://www.amd.com/system/files/documents/amd-memory-guard-white-paper.pdf https://www.amd.com/system/files/documents/amd-memory-guard-...> It may require to have support from the motherboard. EFI firmware has a var (/sys/firmware/efi/efivars/) named MemoryOverwriteRequestControl that if set is supposed to instruct the firmware to overwrite memory on next boot. If you set it and if you can somehow trigger a reboot memory should not be recoverable. You can also set init_on_free=1 in linux cmdline, the kernel will overwrite freed memory. If a reboot is physically interrupted or if the EFI firmware does not honor the var mentioned above, encryption keys and any other private data may have been freed.
- Unklejoe 3y ago> You can also set init_on_free=1 in linux cmdline, the kernel will overwrite freed memory. Does this only work with kernel buffers? I’m wondering how glibc handles freed memory. I feel like there’s a good chance it doesn’t always notify the kernel that the memory has been freed.
- Cody-99 3y agoNone Pro Ryzen CPUs can use Transparent SME (TSME) if the motherboard includes support for it (and many of them do). Like ECC on non Pro Ryzen chips it isn't 'officially supported' but the option is there and works.
- javajosh 3y agoIsn't the solution to make it very hard to remove the ram without destroying it? Like, epoxy it onto the motherboard?
- Dwedit 3y agoThe XBOX-360 had encrypted main memory, which largely warded off bus attacks. It stood as an impenetrable stone wall until the exploits were found.