Feeds

Security boffins unveil BitUnlocker

Disk encryption decrypted

The Essential Guide to IT Transformation

BitLocker, meet BitUnlocker.

Word arrives from The Electronic Frontier Foundation that a crack team of researchers - including the Foundation's own Seth Schoen - have discovered a gaping security flaw in everyday disk encryption technologies, including Microsoft's BitLocker as well as TrueCrypt, dm-crypt, and Apple's FileVault.

If a machine is screen-locked or left in sleep or hibernation mode, Schoen and his cohorts proclaim, an attacker can circumvent disk encryption simply by powering the machine down and quickly re-booting to an external hard drive.

You see, DRAM tends to retain data for up to a minute after power down. When a sleeping machine is "cold booted," its encryption keys stay right there in memory - and they're ripe for the taking.

So, sleeping machines are vulnerable even if they're left alone for a matter of minutes. "Let's say you're in a coffee shop and you leave your Vista notebook screen-locked and tied to a table while you take a trip to the bathroom," researcher Jacob Appelbaum told The Reg. "All I would have to do is force a reboot to a USB drive running our custom software, and I could work around BitLocker."

Yes, their custom software is called BitUnlocker. You can see it in action here.

With certain types of DRAM, a simple cold boot won't do the trick. Data fades too quickly after power down. But Appelbaum and company have also shown that retention rates can be extended by quickly cooling the memory. All they have to do is open up the machine and spray on a little canned air.

What if BitLocker is used in tandem with a TPM (trust platform module) security chip? According to Applebaum, this could mean the machine is even more vulnerable to an UnBitLocker attack. "When a machine boots, it immediately takes the encryption keys out of the TPM," he says, "and puts them into memory." In other words, when there's a TPM in place, Appelbaum can pull his trick on a machine that's already been powered off.

When we say gaping, we mean gaping. ®

Update

Originally, our article said that researchers put the freeze on RAM by spraying liquid nitrogen. Liquid nitrogen was used in some tests, but not in this way.

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.