 |
|
|
You don’t have to be a computer
genius to break data encryptions, a group of researchers from Princeton
University, the Electronic Frontier Foundation and Wind River Systems showed in
a study revealed on Thursday. What you
do need is a little imagination, and voila! - Instant access to encrypted data.
Data thefts have been anything
but rare in the past few years, and they seemed to intensify and keep the pace
with developers’ latest methods of encryption. Experts explained how that was
possible: “DRAMs used in most modern computers retain their contents for seconds
to minutes after power is lost, even at room temperature and even if removed
from a motherboard.”
In other words: vulnerability at
its best. This means that even if the computer has been shut down, the “content
persists sufficiently for malicious (or forensic) acquisition of usable
full-system memory images” and that “limits the ability of an operating system
to protect cryptographic key material from an attacker with physical access,” the
study says.
The experiment was simple: you
don’t need sophisticated equipment to retrieve data from a memory chip, you
just need a cooling device – in this case, a dust remover. The inverted cans of
canned air have been discharged on the chips, which caused temperature to fall
to -50 degrees Celsius. The experiment proved that the cold temperature was
enough to retain data on chips for a longer period of time, and thus permitting
data extraction from the memory chips.
And that was just with the help
of a dust spray! Imagine what liquid nitrogen (-196 degrees Celsius) could do! Data
would be stored for hours, without any power, which would leave plenty of time
for unauthorized data transfer. That goes to show nothing is as safe as we
thought it was.
The experiment included systems
such as BitLocker (Microsoft), TrueCrypt (Linux) or FileVault (Apple), but the
conclusion extended to other similar systems. The study pointed out that “many
who design, deploy, or rely on secure systems are unaware of these phenomena or
the ease with which they can be exploited.”
© 2007 - 2009 - eFluxMedia