Nearly 'all modern computers' affected by cold boot attack, researchers warn

Cold boot attack leaves Apple Dell and Lenovo laptops at risk of data theft

Known for its volatility in data retention when out of power, RAM (Random Access Memory) can preserve information for a longer time - even minutes, under low-temperature conditions. But F-Secure Principal Security Consultant Olle Segerdahl says once achieved, an adversary can successfully perform the attack against even the most hardened, secure computer in about 5 minutes. This type of side-channel compromise require physical access to the computer and this makes it practical against high-value targets rather than regular users.

An "evil maid" could use this attack to extract secrets from laptops left in hotel rooms, and an "evil" IT technician could do the same to an office machine overnight or even during a targeted individual's lunch hour. "And since this type of threat is primarily relevant in scenarios where devices are stolen or illicitly purchased by attackers, it's the kind of thing an attacker will have plenty of time to execute", said Segerdahl.

"It's the kind of thing that attackers looking for bigger phish, like a bank or large enterprise, will know how to use", he added.

"The attack exploits the fact that the firmware settings governing the behaviour of the boot process are not protected against manipulation by a physical attacker", F-Secure wrote in a blog post.

When computers are restarted, the motherboard firmware can wipe the RAM clean to remove any lingering data. After that, the attacker can boot from an external device to read the contents of the system's RAM from before the device went to sleep. Hibernation will clear encryption keys from RAM, but other files could still be at risk.

The technique was demonstrated today (Sept. 13) at the SEC-T security conference in Stockholm. Sweden, and will be presented again September 27 at the BlueHat security conference on the Microsoft main campus in Redmond, Washington.

F-Secure's researchers have found that they can stop the overwriting procedure thus making the computer vulnerable. One of these protections was that computers would overwrite the contents of the RAM when power was restored after a cold boot.

"It takes some extra steps compared to the classic cold boot attack, but it's effective against all the modern laptops we've tested. We are convinced that anybody tasked with stealing data off laptops would have already come to the same conclusions as us". He said that they had notified Intel, Microsoft, and Apple about his team's discovery and are working with these companies to provide better guidance to users and improve the security of current and future products. It is possible to, while a stolen machine is still in sleep mode, reprogram the firmware's settings to disable this memory zero'ing, and then reboot it into a custom operating system on a USB stick or similar that then scans the RAM for any sensitive information.

Apple responded by pointing to the latest generation of Macs, which have the T2 chip that do the encryption separately from the CPU and makes such an attack more hard to execute.

Related News:

  • Seahawks to sign LB Mychal Kendricks after guilty plea to insider trading

    Seahawks to sign LB Mychal Kendricks after guilty plea to insider trading

    The Kendricks signing is not without some concern, as just last week the linebacker pleaded guilty to charges of insider trading. Kendricks isn't expected to be sentenced until January 24, and according to Schefter the Seahawks will put him right to work.
    Kulsoom Sharif to be laid to rest in Lahore today

    Kulsoom Sharif to be laid to rest in Lahore today

    Many workers were seen sobbing while everyone praised the noble personality, suave and humanitarian nature of Begum Kulsoom Nawaz. The former prime minister was looking highly sad and exhausted. "Today was extremely hard after learning of my mother's death".

    FDA proposed crackdown on flavored e-cigs puts Juul on notice

    Under today's announcement, the five largest e-cigarette manufacturers will have 60 days to produce plans to stop underage use of their products.
  • Apple quietly discontinues four older versions of iPhone

    Apple quietly discontinues four older versions of iPhone

    The firm infamously remarked that it had the "courage" to move away from the headphone jack, prompting some ridicule from users. Prices have gone from $649 to the entry level iPhone 7 in 2016 to $1,149 for the largest-capacity, 256GB iPhone X a year ago .
    Gennady Golovkin will puncture the 'Canelo' Alvarez myth, says trainer Abel Sanchez

    Gennady Golovkin will puncture the 'Canelo' Alvarez myth, says trainer Abel Sanchez

    The middleweight pair first fought in September 2017 which was scored as a draw in controversial circumstances. Canelo Alvarez/Gennady "GGG" Golovkin Part II is just days away and the feud is once again heating up.
    New Apple iPhones Confirmed to Support Dual SIM 4G Connectivity

    New Apple iPhones Confirmed to Support Dual SIM 4G Connectivity

    Suffice it to say, you will hopefully be able to pick up the iPhone of your choice, no matter the model, in just a few weeks. If history is any indication, iPhone Xs pre-orders will open up on Friday, September 14 ahead of a release on September 21.
  • Grand Strand sees first power outages as Hurricane Florence nears coast

    Another Wilmington resident said she does not want to leave because she is afraid to see what she would be coming back to. Projections from the National Weather Service show the storm moving into SC late Friday into Saturday.
    Guillem Balague says Saul was offered to Everton and Manchester United

    Guillem Balague says Saul was offered to Everton and Manchester United

    But Barcelona took too much time and the Spanish star then 21 years old, was also hesitant to leave a club he'd been at for almost 10 years.
    Pope orders investigation of United States  bishop accused of sexual misconduct

    Pope orders investigation of United States bishop accused of sexual misconduct

    Bransfield has faced allegations that he sexually abused teenage boys in the 1970s or early 1980s while a priest in Philadelphia. DiNardo's deputy Jose Horacio Gomez and general secretary Brian Bransfield also attended the closed-door meeting.
  • Trump rejects Puerto Rico hurricane death toll, blames Dems

    Trump rejects Puerto Rico hurricane death toll, blames Dems

    Trump reserved his vitriol for San Juan Mayor Carmen Yulin Cruz, who had denounced the poor federal response to the hurricane. One thing's for sure, and I told (the media) before, one thing I'm proud, we're standing up on our own two feet.
    SpaceX to send world's first private passenger around Moon

    SpaceX to send world's first private passenger around Moon

    The BFR is SpaceX's newest rocket, a super powerful launch vehicle with 31 engines and the capacity to lift 150 tons into space. The names and identities of those two tourists - and how much they meant to pay - were never revealed.
    Gareth Southgate has actually compared Marcus Rashford to Cristiano Ronaldo

    Gareth Southgate has actually compared Marcus Rashford to Cristiano Ronaldo

    Last season, he played poorly against Brighton, Mourinho had a pop at him and Lukaku went straight back in the next game. So where does Rashford actually fit in? " I don't see Rashford ever displacing Lukaku so long as he is there ".


Most liked

Bristol-Myers Squibb Co (BMY) Stake Lessened by MetLife Investment Advisors LLC
It represents a security's price that, if achieved, results in a trader recognizing the best possible outcome for his investment. In theory, there is an infinite number of simple moving averages, but the most common are three SMA20, SMA50, and SMA200.

Samsung Galaxy S10 Variant to Feature 5 Cameras
There have been rumours in recent times of a forthcoming Samsung Galaxy A9, which is said to have a four cameras on the rear. Ice Universe had also asserted that the upcoming Galaxy phone won't be called the Galaxy S10 or the long-rumoured Galaxy F .

Trump 'doesn't understand the basics,' says 'Fear' author Bob Woodward
As such, various liberal and conservative commentators called out Eric Trump for his comments in that interview. However, in the process, Eric Trump used some questionable terms live on the air.

Hurricane Florence: Over 188,000 without power as monster storm batters Carolinas
Officials said some 1.7 million people in the Carolinas and Virginia were warned to evacuate, but it's unclear how many did. The coastal area of SC features hundreds of inlets while North Carolina has barrier islands miles away from the mainland.

The Impact Of Hurricane Florence
While Florence is no longer considered a major hurricane, its reach has expanded, threatening residents from Georgia to Virginia. The first tropical-storm-strength winds are now expected to hit on Thursday at 2 p.m. and last throughout the weekend.

Carl Pei confirms the OnePlus 6T won’t have a headphone jack
Time will tell if the company's gamble has paid off, and if OnePlus fans are truly over the traditional headphone jack. We're not doing it for the sake of doing it and because everyone else is.

Hurricane Florence is about to make landfall in North Carolina
At this time, the outer eyewall of Florence was making landfall in the the area of Wilmington, N.C.as a Category 1 hurricane. Waves from Hurricane Florence pound the Bogue Inlet Pier in Emerald Isle, N.C., September 13, 2018.

CBB: Dan Osbourne Speaks Out About Why Rodrigo Alves Was Evicted
Dan said he "really struggled" not being to speak to his children every day, but tried to keep his emotions to himself as he "didn't want to bore people".

United States readies for 'big one' as Hurricane Florence approaches Carolinas
As Hurricane Florence gets closer to the Carolinas, Hurricane Hunters from the Bay area are flying right into the storm. But his partner, Emily Whisler, said she will stay at the university where she is a resident in the psychiatry program.

Hurricane Florence pounds the Carolinas as it nears landfall
As if the storm itself is not risky enough, it is expected to spawn tornadoes in southeast North Carolina on Thursday and Friday. USA carriers were also waiting to see what impact Florence could have on airports near Washington and in northern Virginia.

Meghan Markle's Royal Life Is More Isolating Than Ever
Now it has emerged that Prince Harry's dad, Prince Charles , thinks very highly of his youngest son's new wife. This gesture was just one way that Meghan has tried to keep up with the few remaining friends she has left.

Eminem and Machine Gun Kelly's feud didn't start with Hailie Mathers
Eminem has finally addressed the real reason he chose to diss Machine Gun Kelly on new album Kamikaze , leading to a huge lyrical battle.

Putin's ex-bodyguard challenges Navalny to duel
Navalny" - slammed Navalny's claims as "insulting, slanderous fabrications". "Nobody has given you a quality kick in the ass. Viktor Zolotov also said that Navalny was waving the declaration of the General's income "like a rag" for several years.

Forsaken raid Last Wish start time, power level and more
Bungie eventually came up with a fix for this one-sided end-around, though other exploits still plague the sequel story. You'll be able to courageous The Last Wish Raid in Destiny 2: Forsaken on Friday 14th September at 10am PT / 6pm BST.

Hurricane Florence from space
This image provided by NASA shows Hurricane Florence from the International Space Station on Wednesday, Sept. 12, 2018. The European Space Agency's astronaut, the German Alexander Gerst, called the hurricane a "no-kidding nightmare".