9 ms·
Show HN: Simple demo of a cold boot attack using a Raspberry Pi
- alana314 3y agoI'd never even heard of cold boot attacks. Is there any prevention of this?
- anfractuosity 3y agoI believe both recent Intel and AMD processors enable you to encrypt memory, such as Intel Total Memory Encryption.
- dist-epoch 3y agoThat is correct, AMD Zen4 (Ryzen 7000) supports transparent full memory encryption. It also supports more granular memory encryption, for example to prevent the host accessing VM guest memory.
- Wool2662 3y agoYes, control physical access to the hardware. You can also achieve some mitigation by using encrypted ram.
- bri3d 3y ago* Hardware memory encryption / bus encryption. If implemented correctly, keys never touch RAM and will be discarded instantly across any power disruption. * Control physical access: don’t allow an attacker access to the DRAM chips. * Control logical access: use trusted boot systems which don’t allow an attacker to dump arbitrary memory, combined with physical access control so they can’t directly address memory externally.
- deleted 3y ago[deleted]
- sneak 3y agoKeeping secrets out of main memory, either with registers, encrypted memory, or use of a secure enclave (which in turn uses encrypted memory) for sensitive operations.
- Cheer2171 3y agoIt is important to note they could access an image in the memory up to 0.75 seconds after cutting power, but after 1.0 seconds everything had completely decayed. This sounds less like a "cold boot" attack and more like the residual power is still flowing on the substrate for 0.75 seconds.
- anfractuosity 3y agoI wasn't able to automate the use of the freeze spray alas, but I believe that did let me access data after more significant durations. With the freeze spray I did also manage to unplug the power cable completely and switch SD cards manually. Edit: In "Cold Boot Attacks are Still Hot: Security Analysis of Memory Scramblers in Modern Processors" they say "To assess the feasibility of cold boot attacks on today’s denser and smaller components, we measured the retention time of five DDR3 and two DDR4 modules from various manufacturers. At normal operating temperatures, a significant fraction of the data is lost within 3 seconds of losing power." The Pi 4 I used makes use of DDR4 from what I recall.
- yonatan8070 3y agoWhat results would you expect to get if you simply put the whole setup in a regular freezer? Or if you just tried it during winter
- anfractuosity 3y agoIt sounds like a typical freezer cools to around -20C, I think the freezer spray I used directly on DDR chip, claims to chill to around -50C, but not sure how much the surface temperature decreases after spraying and how fast it warms up again.
- jacquesm 3y agoIndustrial freezers will go to -45, lab freezers to -85 before getting into really exotic stuff.
- yonatan8070 3y agoIt would be interesting to do this with different delays to see how the noise level increases as the delay increases, then once you have a bunch of images recovered, make an animation of the image getting more and more noisy as the time increases, would also be interesting to compare the results for different ambient temperatures, how much more feasable would this be during January in Norway vs August in Texas?
- anfractuosity 3y agoThat's something they did in one of the original papers - "Lest We Remember: Cold Boot Attacks on Encryption Keys" by Halderman et al, with an earlier version of DDR, think it was DDR2. It's something I'd like to try too. Good point re. the temperature also, I bought a PT100 temperature probe I need to use to measure the surface temperature of the RAM chip too.
- RecycledEle 3y agoI hope this leads to NVRAM one day.
- _8j50 3y agoNice work. There is TME for intel, does anyone know its implementation state and if something similar exists for arm? https://www.intel.com/content/www/us/en/developer/articles/news/runtime-encryption-of-memory-with-intel-tme-mk.html https://www.intel.com/content/www/us/en/developer/articles/n...
- oskarw85 3y agoIt's nice to recover an image but encryption keys are not that. One bit flip and it's game over. This experiment is more useful for human-readable document forensics than anything else.
- PrimeMcFly 3y agoa passphrase is much shorter than a key and may be in memory multiple times.
- dist-epoch 3y agoIf from a 128 bit key 120 are correct, it's trivial to figure out the others, even if you don't know which bits are the flipped ones. Cryptographers worry even when a few key bits are leaked.
- tczMUFlmoNk 3y ago> If from a 128 bit key 120 are correct, it's trivial to figure out the others, even if you don't know which bits are the flipped ones. Can you elaborate a bit? Off the top of my head, I feel like that scenario would leave 128-choose-8 possibilities open, or about 1.4 trillion. Are we calling that "trivial" or am I misunderstanding the attack? (If you're calling that "trivial", I think that could be reasonable in a cryptography context where you're considering attackers with a lot of resources. It's just different from how I usually use that word. I don't disagree with your conclusion that leakage of even a few bits is worth worrying about.)
- IanCal 3y agoIf it's 1.4T it depends on what you're using it for. Someone on SO has a verify speed for 512 bit rsa keys at 350k/second which would leave it at I think a month and a half to run 1.4T. That's a random user and a single machine. ECDSA 128 bit verify maybe 6k/s on a single core of a not-great CPU. That puts you about a month or two of a moderate machine assuming there's no fancy gpu things for doing it.
- mjg59 3y agoThis is mitigated by a Trusted Computing Group feature - at boot, the OS sets a non-volatile flag, and clears it again on clean shutdown after wiping any sensitive material from RAM. If the system boots with the flag set then the firmware wipes the RAM before booting anything. This doesn't protect you against someone pulling the RAM out of the system and dumping it there, but that's a much harder attack.
- goriloser 3y agoThere is an actual solution - full memory encryption on recent Intel/AMD CPUs.