Cold Boot Attacks: Vulnerable While Sleeping
February 26th, 2008 by Ed Felten
Our research on cold boot attacks on disk encryption has generated lots of interesting discussion. A few misconceptions seem to be floating around, though. I want to address one of them today.
As we explain in our paper, laptops are vulnerable when they are "sleeping" or (usually) "hibernating". Frequently used laptops are almost always in these states when they're not in active use - when you just close the lid on your laptop and it quiets down, it's probably sleeping.
When a laptop goes to sleep, all of the data that was in memory stays there, but the rest of the system is shut down. When you re-open the lid of the laptop, the rest of the system is activated, and the system goes on running, using the same memory contents as before. (Hibernating is similar, but the contents of memory are copied off to the hard drive instead, then brought back from the hard drive when you re-awaken the machine.) People put their laptops to sleep, rather than shutting them down entirely, because a sleeping machine can wake up in seconds with all of the programs still running, while a fully shut-down machine will take minutes to reboot.
...