News Centre

New Cold Boot Attack Unlocks Any Modern PC

Article by diogo@techpatrol.com.au
September 17, 2018
Security News

SHARE THIS POST:

A new variant of the traditional Cold Boot Attack, which has been around since 2008 lets attackers steal sensitive information that briefly remains in the memory (RAM) after your computer has shutdown and is no longer active. Through this article we will try bring some light into this vulnerability and show you some ways you may be able to protect yourself.

Originally the Trusted Computing Group (TCG) has bundled safeguards that overwrites the contents of the RAM when the power on the device is restored, preventing the data from being read. New, researchers from Finnish cyber-security firm F-secure figured out a new way to disable this overwrite security measure by physically manipulating the computer’s firmware, potentially allowing attackers to recover sensitive information stored within the device after a cold reboot in a matter of minutes.

“Cold boot attacks are a known method of obtaining encryption keys from devices. But the reality is that attackers can get their hands on all kinds of information using these attacks. Passwords, credentials to corporate networks, and any data stored on the machine are at risk,” the security firm warns in a blog post published today.

Video Demonstration of the New Cold Boot Attack

By using a simple tool, researchers were able to rewrite the non-volatile memory chip that contains the memory overwrites settings, disable it, and enable booting from external devices. Like the traditional cold boot attack, the new attack also requires physical access to the target device as well as right tools to recover remaining data in the computer’s memory.

“It’s not exactly easy to do, but it is not a hard enough issue to find and exploit for us to ignore the probability that some attackers have already figured this out,” says F-Secure principal security consultant Olle Segerdahl, one the two researchers.
“It’s not exactly the kind of thing that attackers looking for easy targets will use. But it is the king of thing that attackers looking for bigger phish, like a bank or large enterprise, will know how to use.” He continued.

How Microsoft Windows and Apple users can prevent this attack.

cold boot attack on full disk encryption

This new technique ios believed to be effective against nearly all modern computers and even Apple Macs and can’t be patched easily or quickly. The two researchers who found this have already shared their findings with Microsoft, Intel, and Apple, and helped them explore possible mitigation strategies.

Intel is yes to comment on the matter however, Microsoft updated it’s guidance on Bitlocker counter measures in response to the F-Secure’s findings, while Apple said that it’s Mac devices equipped with an Apple T2 Chip contain security measures designed to protect it’s users against this attack.

However, for Mac computers without the latest T2 chip, Apple recommended users to set a firmware password in order to help harden the security of their computers.

The researchers says there’s no reliable way to “prevent or block the cold boot attack once an attacker with the right know-how gets their hands on a laptop,” but suggest the companies can configure their devices so that attackers using cold boot attacks won’t find anything fruitful to steal.

Recommendation

Meanwhile, the recommendation is for IT departments to configure all company computers to either shut down or hibernate (not enter sleep mode). It’s true that savvy attackers could still perform a successful cold boot attack against computers configured like this, but since the encryption keys are not store in the memory when a machine hibernates or shits down, there will be no valuable information for an attacker to steal. If you need assistance please contact us as soon as possible.