Disk encryption vendors respond to research

Last week, a team of researchers at Princeton University proved that with physical access, secure encryption on a computer's hard drive could be a moot point. Now, nearly a week later, some security companies have responded to the research.

February 29, 2008

Courtesy of The Tech Herald

The research team included the Electronic Frontier Foundation, Princeton University and other independent researchers. Their findings showed a security flaw in several popular disk encryption technologies that left the encrypted data vulnerable to attack. The flaw starts with a simple relatively unknown truth, once a computer is powered down or left in hibernated state, the DRAM does not automatically erase itself, contrary to popular belief.

Because the DRAM does not erase itself, the key, used to decrypt the encrypted drive, still resides in memory. This allows an attacker with physical access to the machine to decrypt all of the information stored on the hard disk. During their research, the team from Princeton cracked several widely used disk encryption technologies, including Microsoft’s BitLocker, Apple's FileVault, TrueCrypt, and dm-crypt.

Microsoft, who was tested during the research, came back with a blog posting that offered no real solutions. They did offer that, "... the thing to keep in mind here is the old adage of balancing security usability and risk For example BitLocker provides several options that allow for a user or more likely an administrator to increase their security protections at the cost of somewhat lowering the ease of use."

Microsoft makes the argument that by using Group Policy Objects, it is possible for an administrator to prevent this form of "cold boot" attack. They use examples such as disabling sleep mode or forcing a user to hibernate. Microsoft also makes the proposal that the risk is minimal simply because, "... the opportunistic laptop thief is somewhat unlikely to carry a separate laptop on which they will have installed tools that allow them to reconstruct cryptographic key's or for that matter have a can of compressed air handy."

While the odds of the thief having a laptop on hand or a can of compressed air are in fact, low. That does not mean you should be any less concerned about the physical security of your hardware. If the thief wants your data bad enough, they will simply remove your hardware and take it to a different location where such tools exist.

TrueCrypt, one of the other vendors tested, reminds users that when a volume is properly dismounted, the data is safe and the key erased. “However, when the computer is reset (not cleanly restarted), when the system crashes, or when the power supply is abruptly interrupted, the TrueCrypt driver stops running and therefore can not erase any keys."

Several other companies, none of them tested, offered press releases and other public statements about the nature of the "cold boot" attacks described by the Princeton University research.

GuardianEdge, another known encryption company, advised its customers to take added protection measures. These measures include, disabling the standby function, restricting the ability to boot from removable media, using a BIOS password and a BIOS that tests and initializes the memory through "power on self test."

Again, the issue is serious; it is also an issue that was suspected for some time; if an attacker can touch the computer, nothing on it is safe. The interesting spin, coming both from the companies tested, and the marketing blitz from the companies not tested, is that everyone agrees; what was once a myth and often scoffed at, is now a reality.

Taking the steps suggested by GuardianEdge, and even those by Microsoft, will help mitigate this type of attack. With that said, physical control of the hardware is still required. If you have not read the research yet, you can link to it here: http://www.freedom-to-tinker.com/?p1257