1. I'm a lot less interested in finding out how to protect myself than getting my hands on that software. It sounds like it would be pretty neat to be able to get RAM dumps like that.

Posted at 3:54PM on Feb 21st 2008 by Chris

2. One of the slashdot comments said that loop-aes considered this in their design.

http://it.slashdot.org/comments.pl?sid=461784&cid=22504940

Posted at 4:20PM on Feb 21st 2008 by m

3. No idea how hard this would be, but how about a RAM clearing button hack? Slap it on your case in case of emergency. Then you can integrate a PIC or something with that that'll clear the RAM as soon as the PC is powered off...or fill it with random data.

Posted at 4:29PM on Feb 21st 2008 by urza

4. Really, can't someone just write a program on some low level that'll execute at shutdown and zero out everything in memory?

Posted at 5:05PM on Feb 21st 2008 by Miles Attacca

5. hmm. i would love to get my hands on that juicy bit of software.

Posted at 5:07PM on Feb 21st 2008 by HaDAk

6. What is next?
encapsulated ram-chips, to avoid tapping the signals?
using single registers on the CPU, which can only be accessed by a hypervisor?
using random adresses in memory to store the key, which will be cleared as soon as the CPU detects a power-down, but after flushing the buffers to avoid filesystem corruption.

Posted at 5:12PM on Feb 21st 2008 by TD-er

7. This begs the question, who needs their data so secure that they implement bios level encryption, yet has their computer set by default to boot from anything but the internal HDD?

So the only computers really vulnerable to this attack are laptops with functioning batteries and encrypted hard disks, that were on when stolen (short of any James Bond bs, they'd have to be, given the conspicuousness of the ram freezing and transfer) and have passed bios, but not user level authentication.

Its interesting attack, but unless you make a habit of carrying around a laptop known to be full of national secrets, which you regularly leave on and unattended, I wouldn't say this constitutes a significant vulnerability.

Posted at 6:34PM on Feb 21st 2008 by Wolf

8. wolf has a point... I think anybody who has data important enough to be highly concerned about this hack, yet are still that vulnerable to it probably deserve to have their data stolen....

Posted at 7:08PM on Feb 21st 2008 by Decalis

9. (Hi, I'm one of the coauthors of the paper in question.)

Having your bios configured to boot from a given device isn't going to secure you against this attack. It may be possible to build software countermeasures when given time to activate them. Part of the nature of the problem is that we don't have that time when an attacker can simply cut the power.

I suggest reading our full PDF and if nothing else, enjoy the key recovery sections for their error correcting beauty.

The software will be released in the future as an open source suite of tools. All in good time.

Posted at 2:12AM on Feb 22nd 2008 by Jacob Appelbaum

10. We used to say "If you want your computer to be secure, unplug it." We may have to modify that statement now. :D

Posted at 5:32AM on Feb 22nd 2008 by Will Spencer

11. Obviously the key should be stored in WOM (Write Only Memory) then nobody could steel it :)

Posted at 7:46AM on Feb 22nd 2008 by Dorit

12. I would like a BIOS feature that clears memory as first step prior to boot. If I could keep the key memory soldered in, that would be good too.

Posted at 10:31AM on Feb 22nd 2008 by Bill Michaelson

13. wouldnt it be possible to create a kind of "hardware codec" wich encripts the ram as well? this would be cool as a new feature for new pc since adding such a codec to an existing pc obviously would be a massive bottleneck ( massive adresse reroute and other problems...)

Posted at 10:39AM on Feb 22nd 2008 by snow

14. Lets fact it.
With this method , there really isn't much you can do to protect a pc that is left in the running state.
All a thief has to do is grab the laptop, drop it in liquid nitrogen or something similar .
Bios will not help because they can just remove the memory as shown. You would need a encryption system that doesn't put the key in ram at any time, thats near impossible.

Posted at 11:45AM on Feb 22nd 2008 by Pixeltricks

15. small duel boot program?
program that wipes the ram on boot.

- you would run a shutdown link in your main os that flags the boot loader to run the memory wipe on reboot.
- the machine would then reboot.
- the wipe program runs then sets a flag that its been run and the main os should boot next time. it then shuts the computer down.

maybe a key stored in a Trusted Platform Module chip?

Posted at 12:37PM on Feb 22nd 2008 by james underhill

16. Some people have mentioned that a smart person would disable USB-booting in the BIOS, but that won't help you if the RAM is moved to another computer...
This hack looks like a pretty big deal. I think you guys underestimate how many end users of secure material might leave their laptop running somewhere with them logged in. Hell, with the value of this data, it wouldn't be unreasonable to see someone rob someone of it at gunpoint.
-Taylor

Posted at 1:10PM on Feb 22nd 2008 by Taylor Alexander

17. the best way is to add a hardware add on. you get this slot that slots into the memory slot once that is connected you put the memory chip onto the slot that you just slotted in.

this hardware will somehow kill or overwrite all data on memory once it detects there is no power being passed thought the memory. most motherboards can take this thing. its the best way but it has one problem. it takes about 10-30 secs depending on your memory and the size of the dump

Posted at 7:26PM on Feb 22nd 2008 by Someone

18. Wouldn't it be ridiculously easy to bypass this whole issue by booting off of some LiveCD Linux or something and running a loop that would require all available system resources after you were done using it? It'd write new values to the RAM, and basically just cover your tracks foolproof. Heck, you could probably even write a script to do this when Windows shuts down. Loop, make sure it fills all available memory, shut down.

Posted at 11:43PM on Feb 22nd 2008 by George

19. Okay, it's cute and all, but this all-lowercase thing is kinda naggy. Worried about all-caps or can you actuall read this without pain?

Posted at 11:44PM on Feb 22nd 2008 by George

20. Underhill: You mean Memtestx86+? Its slow, but it overwrites ram. Doesn't seem too complicated (in theory) to disable the read-back funtionality to speed this process up.

Posted at 12:33AM on Feb 23rd 2008 by lmb