3 ms·
Physical access is always game over.
by hrrsn 14y ago
Physical access is always game over.
- Xylakant 14y agoAn encrypted boot device makes things a little harder, even with physical access.
- huhtenberg 14y agoIn theory, yes. In practice and on Windows it still maps to a lot of (superficial) hassle.
- nodata 14y agoNo it isn't. That would only be true assuming you have a knowledgable attacker. For most cases physical access definitely does not mean game over.
- DanBC 14y agoIf "Bob" has access to my machine I have to assume it's game over, even if I have no idea about "Bob's" ability. Under-estimating the ability of the attacker is a mistake, no?
- Aardwolf 14y agoYes it is: remove harddrive. Put harddrive on other PC. Read contents of harddrive. Or even reboot the existing PC with an OS on USB or optical drive. Unless the HD is encrypted of course, but that is not what this article and password is about.
- Xylakant 14y agoWell, given that you can install a keylogger on the usb keyboard nowadays, it is - even with encrypted harddrives. Or you can freeze the RAM, remove it and read the encryption key. However, encryption makes things quite a bit harder.
- bloblaw 14y agoThe trick with defeating cold boot attacks (aka freezing the RAM) is easily mitigated by a system administrator that forces the system to hibernate instead of sleep (aka write volatile memory to disk). It can also be mitigated by requiring not just the TPM chip, but also a PIN, PASSCODE, or a PASSCODE that is cycled ever 60 seconds or so (on something like an RSA fob). This presumes the system has a TPM chip, or a similar mechanism that can provide an original point for a trusted boot.
- Xylakant 14y agoThe trick is also easily defeated by turning the machine off instead of letting it sleep. Certainly. You could as well just go and make the case locked and hard to break, possibly coupled with an alarm. I was just pointing out that "encrypted disk" does not mean "100% secure".
- illuminate 14y agoAre there seriously examples of the RAM-freezing working, or is this a theoretical attack?
- Xylakant 14y agoIt's proven to work [1],[2] but I have no idea if it's used in the wild. [1] http://www.zdnet.com/blog/security/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/900 http://www.zdnet.com/blog/security/cryogenically-frozen-ram-... [2] https://freedom-to-tinker.com/blog/felten/new-research-result-cold-boot-attacks-disk-encryption/ https://freedom-to-tinker.com/blog/felten/new-research-resul...
- moconnor 14y agoThere's an important difference between being able to unobtrusively compromise a machine by appearing to use it normally and between opening up the case and removing the hard drive, something that attracts attention in almost any setting.
- Deestan 14y agoThe article assumes you have access to reboot the computer from a CDROM or USB stick, which amounts to pretty much the same attack vector.