Snigger. I'll get my trenchcoat...

the only way to resolve this is for software to stop storing keys in memory; but will need some sort of session identifier in order to maintain security etc.

Interesting times!

Have you not already been doing that anyay?

So, lets see...

I now have to set the following BIOS fields:

Chassis Intrusion Detection = Enabled

Chassis Intrusion Action = Reboot

Reboot RAM test = Aggressive

Boot from USB = Disabled

BIOS Password = Enabled

BIOS Password Strength = Very Strong

But, I still have no method of stopping someone simply pulling the plug then getting the RAM out and into another machine before it fades. Time for an on-board battery that is used to wipe the RAM if power is lost.

Everyone to their BIOS!

Enable BIOS password: YES

Allow boot from USB: NO

And then stick a chain round the box to stop anyone doing a BIOS reset!

... that physical security is still the most import layer of any security policy.

The long term fix to this will be fairly simple - a BIOS update that overwrites your RAM with 0's / Random numbers immediately on startup, before it starts hunting for a boot sector somewhere on a USB stick/floppy/harddrive.

Phwooar.

I have yet to own a desktop or laptop that can boot off USB. I thought it a damn nuisance, maybe not so bad now.

What about PIE SSP?

If every stack is loaded into a different place and compiled as such then surely this kind of attack cannot work.

Admittedly you'd have to use a FUSE based file system (so much for a monolithic kernel being good) but you can maintain security against this and many other attacks.

Needing the reboot means a passworded bios set to boot from HDD only is still a defence against this one. I initially thought they were using USB DMA memory sniffing of a live machine like the Firewire DMA attach covered a few weeks ago. Still it's only a matter of time.

Anyone who has suggested disabling USB booting is missing the point: the program could as easily be run from a bootable CD. Possibly even a floppy.

Clearing/over-writing the RAM is just masking the problem - certainly not a 'long term solution'. Passwords simply shouldn't be stored in memory. Jeff may be right on this one, Interesting times...

Er, how?

You read a disk sector, not individual bytes. I don't think you can keep that chunk of data out of RAM without a fundamental redesign of the whole chain from disk platter to CPU registers.

When better physical security, and some BIOS changes, could stop such attacks, why go to such lengths.

Possible the big risk is the inside job?

Jeff - if you look at the actual security risks this sort of attack adds (disregarding physical security), it's primarily drive encryption that can be compromised. And drive encryption requires the key in memory, and somewhere the software can find it.

BIOSes that clear RAM ('full memory test' in POST should do it) would prevent this particular attack.

disable usb boot as per above. Wite chassis switch to fuse of large thermite charges. One surrounding the RAM, the other the Hard drive. Open the door without the proper key to disarm, and the hd and ram go away, along with all of the data. Drastic, but secure.

1. why there is a distinct signature for passwords in memory.

2. why passwords aren't wiped from memory when I lock the machine.

3. why el Reg comments don't provide a 'refer to previous comment' option.

4. why my local supermarket doesn't have fresh bread on Mondays.

1. so your computer can find them.

2. a.Because they will be needed to restart the session.b. Because it's being turned off why bother they will fade anyway slow/hung shutdown can also be a problem.

3. Because we are a pain in their collective asses, and we don't need encouragement.

4. Because they always sell their fresh bread to convenience stores first next day they sell whats left over to the grocery stores. The reason is they get more money for their product at convenience stores and restaurants. The account is worth more gets quicker service. Go to a 7-11 and get that $8.00 loaf of white bread it's fresh.

For God's sake;

'Next time you GO to the loo, TAKE your locked laptop with you' or

'Next time you COME to the loo, BRING your locked laptop with you.

Bloody idiots mashing the English language! That's our job!

Paris, because she knows when to come or go.....

and if you make the charges large enough, goodbye also the bugger trying to open the machine.