Feeds

Security boffins unveil BitUnlocker

Disk encryption decrypted

Internet Security Threat Report 2014

BitLocker, meet BitUnlocker.

Word arrives from The Electronic Frontier Foundation that a crack team of researchers - including the Foundation's own Seth Schoen - have discovered a gaping security flaw in everyday disk encryption technologies, including Microsoft's BitLocker as well as TrueCrypt, dm-crypt, and Apple's FileVault.

If a machine is screen-locked or left in sleep or hibernation mode, Schoen and his cohorts proclaim, an attacker can circumvent disk encryption simply by powering the machine down and quickly re-booting to an external hard drive.

You see, DRAM tends to retain data for up to a minute after power down. When a sleeping machine is "cold booted," its encryption keys stay right there in memory - and they're ripe for the taking.

So, sleeping machines are vulnerable even if they're left alone for a matter of minutes. "Let's say you're in a coffee shop and you leave your Vista notebook screen-locked and tied to a table while you take a trip to the bathroom," researcher Jacob Appelbaum told The Reg. "All I would have to do is force a reboot to a USB drive running our custom software, and I could work around BitLocker."

Yes, their custom software is called BitUnlocker. You can see it in action here.

With certain types of DRAM, a simple cold boot won't do the trick. Data fades too quickly after power down. But Appelbaum and company have also shown that retention rates can be extended by quickly cooling the memory. All they have to do is open up the machine and spray on a little canned air.

What if BitLocker is used in tandem with a TPM (trust platform module) security chip? According to Applebaum, this could mean the machine is even more vulnerable to an UnBitLocker attack. "When a machine boots, it immediately takes the encryption keys out of the TPM," he says, "and puts them into memory." In other words, when there's a TPM in place, Appelbaum can pull his trick on a machine that's already been powered off.

When we say gaping, we mean gaping. ®

Update

Originally, our article said that researchers put the freeze on RAM by spraying liquid nitrogen. Liquid nitrogen was used in some tests, but not in this way.

Internet Security Threat Report 2014

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.