3 ms·

Research of RAM data remanence times

35 points by mkopec 2y ago

westurner 2y ago
From https://blog.3mdeb.com/2024/2024-12-13-ram-data-decay-research/ https://blog.3mdeb.com/2024/2024-12-13-ram-data-decay-resear... : > The main goal is to determine the time required after powering off the platform for all the data to be irrecoverably lost from RAM. Cold boot attack: https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack Data remnance: https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence Ironically, quantum computers have the opposite problem; coherence times for QC qubits are still less than a second: there is not yet a way to store qubits for even one second. (2024: 291±6µs, 2022: 20µs) "Cryogenically frozen RAM bypasses all disk encryption methods" (2008) https://www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/ https://www.zdnet.com/article/cryogenically-frozen-ram-bypas... And that's part of why secure enclaves and TPM.
- westurner 2y ago
  From https://news.ycombinator.com/item?id=37099515 https://news.ycombinator.com/item?id=37099515 : > If quantum information is never destroyed – and classical information is quantum information without the complex term i – perhaps our [RAM] states are already preserved in the universe; like reflections in water droplets in the quantum foam According to the "Air gap malware" Wikipedia article's description of GSMem, the x86 RAM bus can be used as a low power 3G antenna. And, HDMI is an antenna, and, Ungrounded computers leak emanations to the ungrounded microphone port on the soundcard. Air gap malware: https://en.wikipedia.org/wiki/Air-gap_malware https://en.wikipedia.org/wiki/Air-gap_malware Stochastic forensics: https://en.wikipedia.org/wiki/Stochastic_forensics https://en.wikipedia.org/wiki/Stochastic_forensics
  - myself248 2y ago
    Back in the day, we called that https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking
drpixie 2y ago
What's with giving error rates as a count of bits, when it's not clear how much DRAM was tested? There's a comment that the error was around 50% but the graphs should be error percentage, not some (meaningless) absolute number! And there was an interesting feature - error rates didn't seem to change linearly with time, but (strongly for DDR4 and less so for DDR5) the error rate changes in intervals of 8 seconds. That's very much unexpected, so needs a good explanation or indicates a likely error in their procedure.
- Almondsetat 2y ago
  I agree that absolute numbers are a bit strange, but the article states exactly which model of memory was used, namely a W-NM56S508G SODIMM for DDR5 and a KF432C16BB/4 DIMM for DDR4, not to mention the most important part is measuring their different performance between generations
- JoachimSchipper 2y ago
  The error rate is given per bit, not per second, i.e. every few bars represents a distinct DRAM chip. That makes some sense, and the article explains quite well why DRAM would behave like that... but I agree that I had to read the article at least twice to figure out that the x-axis on the graph represents the lower bit of the address line! Still, it's nice to have at least some modern data; https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf https://www.usenix.org/legacy/event/sec08/tech/full_papers/h... is awesome and has much more extensive measurements, but machines from 2007 are somewhat less relevant today.

35 points by mkopec 2y ago

From https://blog.3mdeb.com/2024/2024-12-13-ram-data-decay-research/ https://blog.3mdeb.com/2024/2024-12-13-ram-data-decay-resear... : > The main goal is to determine the time required after powering off the platform for all the data to be irrecoverably lost from RAM. Cold boot attack: https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack Data remnance: https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence Ironically, quantum computers have the opposite problem; coherence times for QC qubits are still less than a second: there is not yet a way to store qubits for even one second. (2024: 291±6µs, 2022: 20µs) "Cryogenically frozen RAM bypasses all disk encryption methods" (2008) https://www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/ https://www.zdnet.com/article/cryogenically-frozen-ram-bypas... And that's part of why secure enclaves and TPM.

westurner 2y ago
From https://news.ycombinator.com/item?id=37099515 https://news.ycombinator.com/item?id=37099515 : > If quantum information is never destroyed – and classical information is quantum information without the complex term i – perhaps our [RAM] states are already preserved in the universe; like reflections in water droplets in the quantum foam According to the "Air gap malware" Wikipedia article's description of GSMem, the x86 RAM bus can be used as a low power 3G antenna. And, HDMI is an antenna, and, Ungrounded computers leak emanations to the ungrounded microphone port on the soundcard. Air gap malware: https://en.wikipedia.org/wiki/Air-gap_malware https://en.wikipedia.org/wiki/Air-gap_malware Stochastic forensics: https://en.wikipedia.org/wiki/Stochastic_forensics https://en.wikipedia.org/wiki/Stochastic_forensics
- myself248 2y ago
  Back in the day, we called that https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking

drpixie 2y ago

What's with giving error rates as a count of bits, when it's not clear how much DRAM was tested? There's a comment that the error was around 50% but the graphs should be error percentage, not some (meaningless) absolute number! And there was an interesting feature - error rates didn't seem to change linearly with time, but (strongly for DDR4 and less so for DDR5) the error rate changes in intervals of 8 seconds. That's very much unexpected, so needs a good explanation or indicates a likely error in their procedure.

Almondsetat 2y ago
I agree that absolute numbers are a bit strange, but the article states exactly which model of memory was used, namely a W-NM56S508G SODIMM for DDR5 and a KF432C16BB/4 DIMM for DDR4, not to mention the most important part is measuring their different performance between generations
JoachimSchipper 2y ago
The error rate is given per bit, not per second, i.e. every few bars represents a distinct DRAM chip. That makes some sense, and the article explains quite well why DRAM would behave like that... but I agree that I had to read the article at least twice to figure out that the x-axis on the graph represents the lower bit of the address line! Still, it's nice to have at least some modern data; https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf https://www.usenix.org/legacy/event/sec08/tech/full_papers/h... is awesome and has much more extensive measurements, but machines from 2007 are somewhat less relevant today.