Asset Protection BLOG - Mark Nestmann: Think Encryption Can Protect Your PC's Secrets? Think Again…

One of the best ways to protect the data on your home or office PC, and—especially—your laptop is to encrypt it.

Encryption is a mathematical process that converts your e-mail messages, your disk files, or even your entire hard drive into unreadable gibberish. Only you—and the intended recipients of your encrypted messages—can decipher the gibberish.

Encryption programs are now available that even the super-computers used by national intelligence agencies cannot decipher messages created with them, at least not without an exhaustive effort.

Unfortunately, recent discoveries by computer security researchers have uncovered a fundamental vulnerability in several popular disk encryption technologies. This vulnerability can leave your encrypted data vulnerable to attack and exposure. Basically, what it involves is harvesting your encryption keys from your PC's memory chips, even if your system is turned off.

In a paper published last week, security researchers affiliated with Princeton University announced they had discovered a way to do this, and thus circumventing various disk encryption products. The researchers say their technique works against Apple's FileVault, the BitLocker Drive Encryption feature included in some versions of Windows Vista, the open-source product TrueCrypt, and the dm-crypt subsystem built into newer versions of Linux. In theory, the attack would also work against my #1 recommended encryption program—PGP Whole Disk Encryption.

To succeed in what the researchers call the “Cold Boot Attack,” an attacker must have physical access to your PC or laptop while it is running or within a few minutes of shutting down. The Princeton researchers discovered that it takes a few minutes after you shut off your PC before the data in your PC's RAM chips is actually gone. During this period, any information remaining in RAM—including your encryption keys and passphrases—may be recovered.

Once upon a time, computer hardware manufacturers assured us that once you turned your PC off, all the data in its memory (RAM) instantly disappeared. Only, it turns out this isn't true.

Here's an example of how your data might be compromised. You're on a flight from London to New York. Just before landing, you turn off your laptop, taking care to insure that all your confidential data is encrypted. You're extra careful, since you know that U.S. customs officials now have the authority to confiscate laptops without probable cause of any wrongdoing. Once they've done so, they can copy the contents, and use that information for whatever purpose they see fit.

You enter the customs queue and you're pulled aside for a secondary inspection. The customs agent asks to see your laptop. He inserts a USB drive into it and turns on the power. Software on the USB drive identifies the encryption keys and reconstructs them, along with your passphrase. Now the agent can read every encrypted file on your laptop.

I should emphasize that this is a hardware issue—it has nothing to do with the strength or weakness of encryption programs. But it means that an attacker could compromise all encrypted data on your PC, even if it's turned off!

Fortunately, there are several precautions you can take to avoid having your data compromised in this manner. I'll describe them in my next blog entry.