Disk encryption might not always protect your data if someone steals or even just "borrows" your computer, thanks to a new "cold boot" hardware attack technique discovered by researchers at Finnish cybersecurity firm F-Secure.
"It's not exactly easy to do, but it's not a hard enough issue to find and exploit for us to ignore the probability that some attackers have already figured this out," Olle Segerdahl, one of the F-Secure researchers who developed the attack, said in a statement released this morning (Sept. 13).
The attack works against almost all Macs and Windows PCs and requires several minutes of physical access to a machine left in sleep mode, which maintains enough power to keep data from the most recent active session "alive" in system memory.
To prevent this, fully shut down the computer or put it in "hibernate" mode when stepping away from the computer for more than a few minutes. Either method will cut off the power and clear the memory.
Microsoft also recommends that enterprise users of its BitLocker disk-encryption software set up a pre-boot PIN that the user must enter to start a computer. Macs with T2 chips — on iMac Pros and 2018 MacBook Pros — are immune to this attack, and Apple recommends that users of other Macs set a BIOS PIN to prevent unauthorized motherboard-firmware changes.
MORE: How to Encrypt Files on Windows
Ordinary computer users don’t need to worry about this attack. But it could be a problem for corporate executives and government officials, whose encrypted computers often contain highly valuable information.
An "evil maid" could use this attack to extract secrets from laptops left in hotel rooms, and an "evil" IT technician could do the same to an office machine overnight or even during a targeted individual's lunch hour.
"It's not exactly the kind of thing that attackers looking for easy targets will use," Segerdahl said. "But it is the kind of thing that attackers looking for bigger phish, like a bank or large enterprise, will know how to use."
Mr. Freeze
A video posted on YouTube by F-Secure shows a user typing out his encryption passwords in a Word document. He then closes the lid of a laptop, putting it in sleep mode, and walks away.
An attacker grabs the laptop, takes it to another desk, removes the battery, pops the lid and sprays the RAM modules with compressed air, freezing them. The attack attaches a specially created tool to attack the motherboard's UEFI module, which alters the boot code to stop the memory overwrite.
The attacker then plugs in a USB stick containing a Linux operating system and boots the machine from that. Using the Linux command line, he easily retrieves the legitimate user's encryption keys. From there, it’s as easy as using those keys to access all the files.
The technique was demonstrated today (Sept. 13) at the SEC-T security conference in Stockholm. Sweden, and will be presented again Sept. 27 at the BlueHat security conference on the Microsoft main campus in Redmond, Washington.
How this attack works
Classic "cold boot" techniques abruptly cut off the power to your computer so hackers can try to access what's in your computer’s memory.
They can either reboot the machine immediately from an external disk, or they can take it apart and literally freeze its memory modules with liquid nitrogen or compressed-air dust sprayers to keep the volatile electrical signals on the RAM modules from changing.
On the memory modules, attackers might find potentially confidential information – encryption keys, passwords, etc. -- that will leave you, and possibly your organization, wide-open to attacks on a larger scale.
Cold-boot attacks were first developed a decade ago, and computer manufacturers now include a memory-overwrite process that, in theory, thwarts any memory-access attempt.
But the F-Secure researchers found a way to bypass that memory overwrite by additionally attacking the BIOS/UEFI firmware that boots the machine and overwrites the memory.
“It takes some extra steps compared to the classic cold boot attack,” Segerdahl told TechCrunch’s Zack Whittaker, “but it’s effective against all the modern laptops we’ve tested ... We are convinced that anybody tasked with stealing data off laptops would have already come to the same conclusions as us.”
Nearly every machine is exposed
Even if your computer’s disk is encrypted with Microsoft BitLocker or Apple’s FileVault, an attacker could perform this new type of cold-boot attack and search your RAM for the disk-encryption keys.
F-Secure says Microsoft, Apple and Intel know of this problem, but the first two can’t do much about it, since the vulnerability that the researchers found lies in the motherboard firmware, which is often made by hardware manufacturers or by third-party firmware suppliers.
Apple told TechCrunch that it is working on “measures to protect Macs that don’t come with [a] T2 chip”, which have a new level of security that fully prevents this type of attack.
