MacBook Air Resistant to Cold-Boot Encryption Attack
The sleek new MacBook Air is one firmware upgrade away from being the only mainstream laptop that is resistant to the cold-boot encryption attacks.One of the most hated things on Apple's new MacBook Air laptops-the fact that it's impossible to upgrade the laptop's RAM-could accidentally turn out to be quite a useful security feature. In fact, according to Ivan Krstic, director of security architecture at OLPC (One Laptop per Child), the sleek new MacBook Air is one firmware upgrade away from being the only mainstream laptop that is resistant to the cold-boot encryption attack discussed recently by researchers at Princeton University and the EFF (Electronic Frontier Foundation).
The research report, released Feb. 21, calls attention to a design limitation in several widely used disk encryption technologies that could allow practical attacks against laptops in "sleep" or "hibernation" mode. It affects Microsoft's BitLocker (Windows Vista), Apple's FileVault (Mac OS X) and TrueCrypt and dm-crypt (Linux).
The research team found that in most computers, RAM contents will persist from several seconds to a minute even at room temperature and that cheap refrigerants like canned air spray dusters can be used to produce temperatures cold enough to make RAM contents last for a long time even when the memory chips are physically removed from the computer.
The researchers used homemade tools and programs to collect the contents of memory after the computers were rebooted, rendering the disk encryption technologies useless, especially when a laptop is turned on but locked, or in a "sleep" or "hibernation" mode when the cover is shut.
However, as OLPC's Krstic points out, the fact that Apple soldered the MacBook Air's 2GB of DDR2 SDRAM directly onto the motherboard means that the machine is highly resistant to the attack scenario of removing the chips from the computer.
"It means that if Apple released an EFI firmware update for the Air which zeroized the RAM contents at the beginning of every boot, the Air would become one of the only-if not the only-mainstream laptop featuring full-disk encryption that's highly-resistant to the troublesome Princeton attack," Krstic said.