cryptographic key material with physical access to an encrypted
machine. Watch the video embedded below to find out how existing
technology is really vulnerable against Cold Boot Attacks on Encryption Keys.
All you need is a Duster spray can, if that, to cool the DRAM and extract the keys. The paper published
along with the video clearly outlines techniques for finding keys
residing in memory.The really cool part is that this technique doesn't
really hack into the encryption directly. Rather, it depends on
scanning the encryption keys by accessing the contents of the RAM and
then extracting the data either by directly tampering with the RAM or
by simply booting the computer from a USB drive. You can also read the
industry response and more details on these findings in the news.com article.
It is not all bad news ... Intel is planning on releasing a
technology code named “Danbury” which drastically reduces exposure to
the Cold boot attacks. Please note that Danbury technology will be part of the Intel vPro processor technology to be released later this year. Danbury uses dedicated platform hardware to
provide full disk encryption and the actual data encryption keys are
not kept in the DRAM. Although, Intermediate, or ‘wrapping’, keys used
to unlock data encryption keys are stored in DRAM temporarily,
when the user is physically present or while remote IT operation has
control of the platform. These keys are subsequently deleted once no
longer needed, thus reducing the exposure significantly.
I am also very happy to announce that Danbury SDK that can leveraged
