LandzDown Forum

Security => Security Alerts & Briefings => Topic started by: Eric the Red on February 23, 2008, 11:51:52 AM

Title: Cold Boot Attacks on Disk Encryption
Post by: Eric the Red on February 23, 2008, 11:51:52 AM
So, you use disk encryption to prevent your data from being stolen? Do you hibernate your laptop or lock your screen with a password protected screensaver?

Yes? Then you had better read the article at the link below - your data is not as safe as you thought that it was, even if the machine is unplugged.

http://citp.princeton.edu/memory/
Title: Re: Cold Boot Attacks on Disk Encryption
Post by: Aaron Hulett on February 26, 2008, 01:36:36 AM
The claims detailed in the Princeton paper are not vulnerabilities, per-se, but simply detail the fact that contents that remain in a computer's memory can be accessed by a determined 3rd party if the system is running. BitLocker is an effective solution to help safe guard personal and private data on mobile PCs and provides a number of protection options that meet different end-user needs.  Like all full volume encryption products BitLocker has a key-in memory when the system is running in order to encrypt/decrypt data, on the fly, for the drive/s in use.  If a system is in 'Sleep mode' it is, in effect, still running. We recognize users want advice with regards to BitLocker and have published best practice guidance in the Data Encryption Toolkit (available here: http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencryption/analysis/4e6ce820-fcac-495a-9f23-73d65d846638.mspx).  In it we discuss the balance of security and usability and detail that the most secure method to use BitLocker is hibernate mode and with multi-factor authentication.

Thanks,

Aaron
Microsoft Corporation

This information is provided "AS IS" without warranty, and confers no rights.