William Jackson | New threat in from cold
Connecting state and local government leaders
Cybereye'commentary: Researchers discover that chilling memory chips can defeat disk encryption.
A recent report detailing successful exploits against popular disk encryption tools has gotten a lot of attention in the past few weeks. It turns out that memory in dynamic RAM (DRAM) chips is not quite as dynamic as often thought, and a team of researchers from Princeton University, the Electronic Frontier Foundation and Wind River Systems, with support from the Homeland Security Department, have developed tools and techniques to recover data from chips well after they have been powered down.The threat is real, particularly if you are a high-value target with sophisticated enemies lying in wait for your data. But full-disk encryption is not broken, and there are simple ways to mitigate the threat.Memory in DRAM chips is supposed to disappear when the power goes away. And it does ' eventually.'Ordinary DRAMs typically lose their contents gradually over a period of seconds, even at standard operating temperatures and even if the chips are removed from the motherboard, and data will persist for minutes or even hours if the chips are kept at low temperatures,' the researchers wrote in their report, 'Lest We Remember: Cold Boot Attacks on Encryption Keys.'By chilling chips to prolong memory and using algorithms to recognize and recover cryptographic keys, researchers were able to defeat several disk encryption systems, including BitLocker, TrueCrypt and FileVault.The cryo-crypto attack is not new. 'It's been in the toolbox of forensics examiners for some time,' said Murugiah Souppaya, a researcher at the National Institute of Standards and Technology.What is new is the researchers' ability to identify cryptographic keys and rebuild them after bits had begun decaying. They were able to reconstruct 128-bit Advanced Encryption Standard keys on which 10 percent of the bits had decayed in a matter of seconds.They also developed reconstruction techniques for Data Encryption Standard and RSA keys.The simplest way to protect yourself from this attack is to turn off your computer or put it in hibernation rather than sleep mode before leaving it. This cuts power to the DRAM, and if you stay with the computer for a few seconds before walking away, the memory will have faded enough to protect you. With tools such as BitLocker, you also can improve security by using it in a mode requiring a token to provide additional cryptographic key material. This means that a complete key will not be available on the DRAM.Bill Burr, manager of the security technology group at NIST's Information Technology Lab, said the DRAM attack is not an attack on the cryptography itself. Protecting crypto keys will always remain a challenge.'This is another manifestation of what cryptographers call side-channel attacks,' Burr said. 'It's a sneak-around attack. And like the poor, side channels shall ever be with us.'XXXSPLITXXX-A new bill aimed at curbing online fraud has been introduced in the Senate: the Anti-Phishing Consumer Protection Act of 2008 (GCN.com/991), which gives broad power to federal agencies to take action against phishers who trespass on their domains. The bill would prohibit phishing, which it defines as 'the collection of identifying information of individuals by false, fraudulent or deceptive means through the Internet.' It also bans cybersquatting, the practice of registering an Internet domain using someone else's trademark, and criminalizes the use of phony information in registering a domain. In addition to giving the Federal Trade Commission power to prosecute violations as unfair or deceptive trade practices, the bill would give states and aggrieved individuals and organizations the right to take action. But many other federal regulators would also have enforcement powers when phishers target companies in the industries they oversee. The Federal Deposit Insurance Corp., Comptroller of the Currency and National Credit Union Administration could handle cases involving financial institutions, which are frequent targets of spammers. The Securities and Exchange Commission could go after cases in which brokers or dealers are spoofed, and the secretaries of Agriculture and Transportation and the Federal Communications Commission could also enforce the law. The bill was referred to the Commerce, Science and Transportation Committee in February. It is hard to imagine it will get much attention in this election year, however. Senators and representatives still have a pile of unfinished business on their plates that will likely take precedence over phishing ' if they get around to doing any legislating at all this year.
Cybereye columnist
William Jackson
Rick Steele
NEXT STORY: Senate revisits FISMA