Researchers find way to foil disk encryption

Disk encryption software used on many systems can be circumvented using what researchers referred to as "simple non-destructive techniques".

A report from researchers at the Electronic Frontier Foundation, Princeton University and Wind River Systems concluded that many current consumer disk encryption programs can be compromised via a computer's DRam.

The problem is that data can remain stored in memory even after the system is shut down. By cold-booting the system, an attacker could access data from the DRam and retrieve encryption keys.

"Most experts assume that a computer's memory is erased almost immediately when it loses power, or that whatever data remains is difficult to retrieve without specialised equipment," said the researchers.

"Ordinary DRam typically loses its contents gradually over a period of seconds, even at standard operating temperatures.

"Even if the chips are removed from the motherboard, the data will persist for minutes or even hours if the chips are kept at low temperatures."

The researchers claimed that laptops are at particular risk because an attacker could use the tactic to break into a system even if screen locks are in place.

To counter the attacks, the researchers suggested that system builders take measures to make data on memory chips decay more rapidly or block the use of memory-dump software used to retrieve data from memory chips.

However, the researchers concluded that the problem will not be easy to solve.

"Unlike many security problems, this is not a minor flaw; it is a fundamental limitation in the way these systems were designed," said Princeton researcher J. Alex Halderman.

"We have broken disk encryption products in exactly the case when they seem to be most important these days."