Feeds

Security boffins unveil BitUnlocker

Disk encryption decrypted

SANS - Survey on application security programs

BitLocker, meet BitUnlocker.

Word arrives from The Electronic Frontier Foundation that a crack team of researchers - including the Foundation's own Seth Schoen - have discovered a gaping security flaw in everyday disk encryption technologies, including Microsoft's BitLocker as well as TrueCrypt, dm-crypt, and Apple's FileVault.

If a machine is screen-locked or left in sleep or hibernation mode, Schoen and his cohorts proclaim, an attacker can circumvent disk encryption simply by powering the machine down and quickly re-booting to an external hard drive.

You see, DRAM tends to retain data for up to a minute after power down. When a sleeping machine is "cold booted," its encryption keys stay right there in memory - and they're ripe for the taking.

So, sleeping machines are vulnerable even if they're left alone for a matter of minutes. "Let's say you're in a coffee shop and you leave your Vista notebook screen-locked and tied to a table while you take a trip to the bathroom," researcher Jacob Appelbaum told The Reg. "All I would have to do is force a reboot to a USB drive running our custom software, and I could work around BitLocker."

Yes, their custom software is called BitUnlocker. You can see it in action here.

With certain types of DRAM, a simple cold boot won't do the trick. Data fades too quickly after power down. But Appelbaum and company have also shown that retention rates can be extended by quickly cooling the memory. All they have to do is open up the machine and spray on a little canned air.

What if BitLocker is used in tandem with a TPM (trust platform module) security chip? According to Applebaum, this could mean the machine is even more vulnerable to an UnBitLocker attack. "When a machine boots, it immediately takes the encryption keys out of the TPM," he says, "and puts them into memory." In other words, when there's a TPM in place, Appelbaum can pull his trick on a machine that's already been powered off.

When we say gaping, we mean gaping. ®

Update

Originally, our article said that researchers put the freeze on RAM by spraying liquid nitrogen. Liquid nitrogen was used in some tests, but not in this way.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.