Freezing the Cold-Boot Attack

A security expert next week at Black Hat USA will reveal the technical details of methods he developed for protecting an encrypted machine against the cold-boot attack recently discovered by researchers at Princeton University .

The software-based techniques defend against so-called cold boot attacks on machines that were recently shut down or are in hibernate or screen-lock modes, by protecting the encryption keys themselves. The cold boot attack basically takes advantage of a brief window when cryptographic keys remain stored in DRAM at shutdown or in sleep mode to then retrieve those keys.

To date, most preventative measures have required users to turn off their machines when they were finished, and to then sit and watch them for about five minutes, says Patrick McGregor, CEO of BitArmor, which has built technology to defend against cold-boot attacks.

“Some people have dismissed the cold boot attack as a minor issue, but that’s not true. To pull off the attack, all you have to do is literally stick a USB into the laptop you get your hands on,” McGregor says. “It doesn’t require any technical skill -- you can easily get automated tools to perform the attack for you.”

The epidemic of stolen laptops has brought the vulnerability to the fore: last year, over 600,000 laptops were stolen from airports alone, McGregor notes. “And all the information on those machines is vulnerable to cold-boot attacks.”

McGregor and his team at BitArmor have developed a few technologies to protect against these attacks. One automatically scrubs encryption keys stored in memory when the machine hibernates or is shut down. “So if someone grabs the device, they can’t access anything,” he says.

It basically overwrites the memory that contains the cryptographic keys. “This uses advanced techniques that take advantage of how memory works in hardware,” he says. “Since cold boot attacks can boot an alternative operating system to which they dump the contents of the memory to sift through it for keys, we make sure the keys are erased before the OS is booted.”

As for the chilling cool-down attack, the Princeton researchers demonstrated to extend the availability of crypto keys in DRAM, McGregor and his team have built a tool that uses the machine’s temperature sensor to prevent such a breach. “We can detect when people try to cool down the machine [so they can] keep the memory from fading, and the [method] destroys the keys and shuts down the computer,” he says.

BitArmor also creates a virtual secure enclave for crypto keys in software, McGregor says. “[It’s] a virtual, protected area for keys to be used in a system. So cold boot is not able to access any of the keys for encryption,” he says. “It’s as if we created a virtual piece of hardware where the keys would be stored and utilized.”

McGregor says BitArmor has added these technologies to its DataControl software, although the improvements have not been formally announced. He'll drill down into those technologies on August 7 at Black Hat in Las Vegas.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.