Truecrypt, bitlocker, filevault

Modelworks

Lifer
Feb 22, 2007
16,240
6
76
Well, so much for encrypting files.


http://citp.princeton.edu/memory/

Abstract Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems ? BitLocker, FileVault, dm-crypt, and TrueCrypt ? using no special devices or materials. We experimentally characterize the extent and predictability of memory remanence and report that remanence times can be increased dramatically with simple techniques. We offer new algorithms for finding cryptographic keys in memory images and for correcting errors caused by bit decay. Though we discuss several strategies for partially mitigating these risks, we know of no simple remedy that would eliminate them.
 

MiniDoom

Diamond Member
Jan 5, 2004
5,307
0
71
Thanks, Interesting read and video. It seems that having physical access to any system (routers, computers) makes getting in a whole lot easier.
 

Jeff7

Lifer
Jan 4, 2001
41,599
18
81
Could encryption software put in some function then that, upon dismounting a volume (at least in the case of Truecrypt), it could do multiple overwrites of the memory locations where it stored its encryption key?

I also thought, if they could somehow improve this effect, could it lead to cheaper NVRAM?

Having systems with storage systems that have nanosecond access time, GB/sec read/write speeds, and power-independent data retention capability could rewrite portions of software. No more losing your data when Word crashes - it could save your work to disk every time you do anything, just as it already does when it stores you data in RAM. No more need to save your work on exiting a program - it'll already be saved by simple virtue of you having performed the action. And of course, load and search times would be greatly reduced.
 

Modelworks

Lifer
Feb 22, 2007
16,240
6
76
I think the biggest threat from this method is laptops.
Lots of people carry them around in sleep mode.
And since they are easy to carry and steal, they are prime targets.
 

rasczak

Lifer
Jan 29, 2005
10,453
22
81
Originally posted by: Modelworks
Well, so much for encrypting files.


http://citp.princeton.edu/memory/

Abstract Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems ? BitLocker, FileVault, dm-crypt, and TrueCrypt ? using no special devices or materials. We experimentally characterize the extent and predictability of memory remanence and report that remanence times can be increased dramatically with simple techniques. We offer new algorithms for finding cryptographic keys in memory images and for correcting errors caused by bit decay. Though we discuss several strategies for partially mitigating these risks, we know of no simple remedy that would eliminate them.
i read this on the other day. it was great reading.
 

rasczak

Lifer
Jan 29, 2005
10,453
22
81
Originally posted by: Modelworks
I think the biggest threat from this method is laptops.
Lots of people carry them around in sleep mode.
And since they are easy to carry and steal, they are prime targets.
it doesn't even need to be in sleep mode. some ram will hold their charge for upto 60 seconds after shut down and that doesn't take into account that the data residing in the memory doesn't corrupt as quickly as most people would think. this article opened my eyes to the reality that nothing is safe. with one being frozen with liquid nitrogen for much longer than that. all you need is a can of dustoff and youre in business.
 

Rubycon

Madame President
Aug 10, 2005
17,768
485
126
Disable hibernate (memory written to hiberfil.sys would have it?). Disable sleep and always shut it down and have a BIOS password. That should make it relatively safe? Or just don't store anything critical on the local hard drive. Of course if you use MS Office things get complicated because those programs tend to store fragments of documents in places on the local drive.

Or just go to a proximity system - if the pc gets separated from the authorized user beyond the threshold distance its battery goes hypercritical and explodes! J/K

Memory temp is interesting though! I might have to try that with a cache DIMM on one of these SAS controllers. Going by that I should be able to chill it with freon, disconnect the battery and shut down the system, take it out and put it in another controller and the contents would still be there. Nice hack for short term transportable cache WITHOUT a BBU! :D
 

ViviTheMage

Lifer
Dec 12, 2002
36,187
82
91
madgenius.com
haha, I am glad it works against Apple, they think they are so safe!

I always shut down my laptop prior to moving it, also have a password upon BIOS boot. I do other sort of encryption, but there is no real sensitive data on my laptop.

I also thought that if you restarted it cleared the ram, or is that a process that windows does prior to boot?
 

rasczak

Lifer
Jan 29, 2005
10,453
22
81
Originally posted by: Rubycon
Disable hibernate (memory written to hiberfil.sys would have it?). Disable sleep and always shut it down and have a BIOS password. That should make it relatively safe? Or just don't store anything critical on the local hard drive. Of course if you use MS Office things get complicated because those programs tend to store fragments of documents in places on the local drive.
well, that depends you can erase the bios password very easily on the desktop. on the laptop it takes a bit more doing but you can crack that as well. and if they already have a system ready to go all they really need to do anyway is rip the ram out and place it into the waiting computer anyway so all of that security goes out the window.

there really is no safe way to safeguard your data anymore. if someone wants it they'll find a way to get it. needless to say that should in no way deter you from best practice in IT security
 

OdiN

Banned
Mar 1, 2000
16,431
3
0
Just make a system that shoves 500 volts through the RAM if it is removed while the system is running. That ought to do it.
 
Oct 25, 2006
11,036
9
91
However, if you enable the best protection measures on Bitlocker, the exploit does not work. Was in the Times today.
 

FoBoT

No Lifer
Apr 30, 2001
63,089
12
76
fobot.com
that reminds me of the anti-theft device in James Bond's car , the one where the car exploded into little bits when the bad guy busts the window out to steal james bonds car
 

PokerGuy

Lifer
Jul 2, 2005
13,650
200
101
Am I missing something or is this not an issue if you dismount a mounted encrypted volume prior to sleeping or hibernating?

If you have a volume that's encrypted and you dismount it, the password should no longer be in memory, correct? I know for certain that PGP takes a bunch of measures to make sure the key does not remain in memory after you dismount.... Does truecrypt not do that?
 

irishScott

Lifer
Oct 10, 2006
21,568
3
0
Originally posted by: GTaudiophile
I wonder if this has been posted over in the Truecrypt forum yet.
http://forums.truecrypt.org/viewtopic.php?t=9410

Inherently, unencrypted master keys have to be stored in RAM as well. When a TrueCrypt volume is dismounted, TrueCrypt erases its master keys (stored in RAM). When the computer is cleanly restarted, all TrueCrypt volumes are automatically dismounted (thus, all master keys stored in RAM are erased by the TrueCrypt driver). However, when the computer is reset (not cleanly restarted), when the system crashes, or when power supply is abruptly interrupted, the TrueCrypt driver stops running and therefore cannot erase any keys.
 

GTaudiophile

Lifer
Oct 24, 2000
29,776
29
81
Originally posted by: irishScott
Originally posted by: GTaudiophile
I wonder if this has been posted over in the Truecrypt forum yet.
http://forums.truecrypt.org/viewtopic.php?t=9410

Inherently, unencrypted master keys have to be stored in RAM as well. When a TrueCrypt volume is dismounted, TrueCrypt erases its master keys (stored in RAM). When the computer is cleanly restarted, all TrueCrypt volumes are automatically dismounted (thus, all master keys stored in RAM are erased by the TrueCrypt driver). However, when the computer is reset (not cleanly restarted), when the system crashes, or when power supply is abruptly interrupted, the TrueCrypt driver stops running and therefore cannot erase any keys.
So TrueCrypt seems to have this vulnerability taken care of?
 

TheKub

Golden Member
Oct 2, 2001
1,756
1
0
So hardware mfgs would need to have a battery circuit installed that if power is killed abruptly that it powers a circuit to scramble\delete memory. Of course if it was just like a button cell you could remove the battery before powering down and circumvent the protection. So we would need to have it as a permanent fixture maybe a capacitor (battery could fail over time but a capacitor would be charged with each boot) that is covered in epoxy and difficult to remove without obliterating the mobo. I wonder what happens if you pull the memory from a live powered on machine, if the data is still readable (didn?t fry the chip) that too would bypass the protection.
 

JackBurton

Lifer
Jul 18, 2000
15,993
14
81
If you want to be REALLY safe, just enable the TPM chip on your laptop (business laptops usually have them), done! You ain't getting past that.
 

irishScott

Lifer
Oct 10, 2006
21,568
3
0
Originally posted by: GTaudiophile
Originally posted by: irishScott
Originally posted by: GTaudiophile
I wonder if this has been posted over in the Truecrypt forum yet.
http://forums.truecrypt.org/viewtopic.php?t=9410

Inherently, unencrypted master keys have to be stored in RAM as well. When a TrueCrypt volume is dismounted, TrueCrypt erases its master keys (stored in RAM). When the computer is cleanly restarted, all TrueCrypt volumes are automatically dismounted (thus, all master keys stored in RAM are erased by the TrueCrypt driver). However, when the computer is reset (not cleanly restarted), when the system crashes, or when power supply is abruptly interrupted, the TrueCrypt driver stops running and therefore cannot erase any keys.
So TrueCrypt seems to have this vulnerability taken care of?
Looks like it, but if your comp is in sleep mode/stand by, the exploit still applies if the volume is mounted (truecrypt automatically dismounts on Hibernation)
 

theGlove

Senior member
Jan 13, 2005
884
0
0
really confused, as i understand it, you are at risk (truecrypt for example) if you have a encrypted file mounted on a drive and you go to sleep mode or you don't cleanly reboot the machine? But you are safe if you have already dismounted file and reboot machine clean?
 

irishScott

Lifer
Oct 10, 2006
21,568
3
0
Originally posted by: theGlove
really confused, as i understand it, you are at risk (truecrypt for example) if you have a encrypted file mounted on a drive and you go to sleep mode or you don't cleanly reboot the machine? But you are safe if you have already dismounted file and reboot machine clean?
This is how I read it:

If the volume is properly dismounted, you're safe. If it's not, you're vulnerable. Truecrypt dismounts:

1. When you reboot (and I assume shut down) your computer properly (ie: via start menu)
2. When you go into Hibernate
3. When you dismount manually

If your comp is in sleep mode/stand by, all that happens is it goes into a really low power state. The RAM and OS are still minimally active. Truecrypt does not dismount IIRC.

Likewise, if your computer crashes or you do a hard boot, truecrypt just gets ended with everything else and doesn't have time to do it's job, leaving the key in the ram.
 

ASK THE COMMUNITY