Cold Boot Attacks: Vulnerable While Sleeping

Mar 01, 2008 1 Replies
Cold Boot Attacks: Vulnerable While Sleeping open original image

Cold Boot Attacks: Vulnerable While Sleeping



February 26th, 2008 by Ed Felten



Our research on cold boot attacks on disk encryption has generated lots of interesting discussion. A few misconceptions seem to be floating around, though. I want to address one of them today.



As we explain in our paper, laptops are vulnerable when they are "sleeping" or (usually) "hibernating". Frequently used laptops are almost always in these states when they're not in active use - when you just close the lid on your laptop and it quiets down, it's probably sleeping.



When a laptop goes to sleep, all of the data that was in memory stays there, but the rest of the system is shut down. When you re-open the lid of the laptop, the rest of the system is activated, and the system goes on running, using the same memory contents as before. (Hibernating is similar, but the contents of memory are copied off to the hard drive instead, then brought back from the hard drive when you re-awaken the machine.) People put their laptops to sleep, rather than shutting them down entirely, because a sleeping machine can wake up in seconds with all of the programs still running, while a fully shut-down machine will take minutes to reboot.



...



formatting link


Monty Solomon wrote: ...

There is some good discussion at the above forum, but that is not the same as peer-review. While the research is stimulating, Ed (not Monty) Felten makes a few small errors. First, anybody knows that clear code is in RAM if you let the system sleep/stand-by. No secure system should be permitted to use that state. Second, as Lazlo Hars points out, no encryption key should be stored in RAM, but I'll bet a lot of s/w does exactly that. - RM

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required