Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
BlueHat Security Conference, profile picture
Uploaded byBlueHat Security Conference
PDF, PPTX1,509 views

BlueHat v18 || An ice-cold boot to break bit locker

The document discusses cold boot attacks that exploit the retention of secrets in RAM after power loss, presenting two methods for data retrieval. It highlights the inadequacy of current security measures, including Secure Boot and BIOS protections, in preventing such attacks, especially in sleep mode. Recommendations include keeping firmware updated, using effective mitigations, and assessing the risks of potential disk encryption breaches.

Technology◦
Download as PDF, PPTX
AN ICE-COLD BOOT TO BREAK THE BITLOCKER Olle Segerdahl & Pasi Saarinen
WHOWEARE § Olle Segerdahl § Principal Security Consultant § Background in verifying security of cryptographic products § Pasi Saarinen § Technical Security Consultant § Worked with 5G security & formal protocol verification methods
THEASSIGNMENT
ATTACKTREE Out of scope Too hard? Soldered to device DMA protections Prio 2
ATTACK ON OS OR COLD BOOT
COLDBOOTATTACK §RAM contains secrets when OS is booted §Secrets remain some time after power is lost § Cooling RAM increases retention time §Two possible approaches: § Remove memory module and read on other machine § Leave memory in place and boot dumping software
TIMOSWORK
MEMORY WIPED!
TCGPLATFORMRESET ATTACKMITIGATION
TCGPLATFORMRESET ATTACKMITIGATION
TCGPLATFORMRESET ATTACKMITIGATION
WESHOULDTRYTHAT...
DEMO?
CAVEAT: BOOTEDMACHINEREQUIRED (Encryption keys have to be in memory to be stolen!)
BUT,BUT,BUT… § I have Secure Boot with TPM enabled! § You can’t boot from USB on my machine! § Surely my BIOS password will save me? § Ha! My laptop has tamper switches!
SECUREBOOT §Only allows EFI programs signed by Microsoft to run §Linux uses a ”Shim” bootloader signed by Microsoft §Allows manual enrollment of whitelisted EFI programs
BOOTORDER §Boot order is locked down in BIOS settings! §Change boot order through changing EFI variable ”BootOrder” §Re-enable disabled boot options by modifying EFI variables §Replace allowed boot device (physical access, remember?)
BIOSPASSWORD §BIOS or EFI Setup is password protected! §Modifying firmware can clear or bypass password! §Many PC vendors have a backdoor - http://bios-pw.org/
TAMPERDETECTION §Aha! My laptop has hardware tamper switches! §Know the hardware you are working with, google for teardowns and ebay listings! §All switches we have seen are easily bypassable…
BIOSSECURITYSETTINGS? Also depend on integrity of firmware or firmware settings… … which can be manipulated!
SUMMARY § Device encryption depends on integrity of firmware code and settings § Physical attacks on firmware can bypass existing security features § Existing mitigations not enough to protect against cold boot attacks
Today: Sleep mode is vulnerable mode!
VENDORRESPONSE Physical (open chassis) attacks are currently listed as out of scope for the TCG specification.
RECOMMENDATIONS For all organisations: §Keep firmware up to date on all devices! §Use existing mitigations (secure boot, firmware password, etc.) §Make sure response procedures work, invalidate credentials, etc. §Be wary of lost devices that are ”found” a while later… §Conduct impact assessment of disk encryption breach scenario
RECOMMENDATIONS If justified by the impact assessment: §Pre-boot TPM+PIN and aggressive hibernation policy §Evaluate effectiveness of firmware integrity protections §Consider adding physical tamper resistance measures
BlueHat v18 || An ice-cold boot to break bit locker