One of the most hated things on Apple’s new MacBook Air laptops-the fact that it’s impossible to upgrade the laptop’s RAM-could accidentally turn out to be quite a useful security feature.
In fact, according to Ivan Krstic, director of security architecture at OLPC (One Laptop per Child), the sleek new MacBook Air is one firmware upgrade away from being the only mainstream laptop that is resistant to the cold-boot encryption attack discussed recently by researchers at Princeton University and the EFF (Electronic Frontier Foundation).
The research report, released Feb. 21, calls attention to a design limitation in several widely used disk encryption technologies that could allow practical attacks against laptops in “sleep” or “hibernation” mode. It affects Microsoft’s BitLocker (Windows Vista), Apple’s FileVault (Mac OS X) and TrueCrypt and dm-crypt (Linux).
The research team found that in most computers, RAM contents will persist from several seconds to a minute even at room temperature and that cheap refrigerants like canned air spray dusters can be used to produce temperatures cold enough to make RAM contents last for a long time even when the memory chips are physically removed from the computer.
The researchers used homemade tools and programs to collect the contents of memory after the computers were rebooted, rendering the disk encryption technologies useless, especially when a laptop is turned on but locked, or in a “sleep” or “hibernation” mode when the cover is shut.
However, as OLPC’s Krstic points out, the fact that Apple soldered the MacBook Air’s 2GB of DDR2 SDRAM directly onto the motherboard means that the machine is highly resistant to the attack scenario of removing the chips from the computer.
“It means that if Apple released an EFI firmware update for the Air which zeroized the RAM contents at the beginning of every boot, the Air would become one of the only-if not the only-mainstream laptop featuring full-disk encryption that’s highly-resistant to the troublesome Princeton attack,” Krstic said.
Microsoft Reacts
Microsoft has already reacted to the Princeton/EFF discovery with a note stressing that the claims against Vista do not point to vulnerabilities.
“[They] simply detail the fact that contents that remain in a computer’s memory can be accessed by a determined third party if the system is running,” Microsoft said in a statement sent to eWEEK.
“BitLocker is an effective solution to help safeguard personal and private data on mobile PCs and provides a number of protection options that meet different end-user needs,” the Microsoft spokesperson explained. “Like all full volume encryption products, BitLocker has a key-in memory when the system is running in order to encrypt/decrypt data, on the fly, for the drive/s in use. If a system is in ‘sleep mode’ it is, in effect, still running.”
Microsoft suggests that the most secure method to use BitLocker is in hibernate mode and with multi-factor authentication.
According to Robert Hensing, a software engineer in Microsoft’s SWI (Secure Windows Initiative) team, this class of attack is not new and was actually raised at the 2006 Hack in the Box conference in Kuala Lumpur, Malaysia.
“[It was] definitely known and threat modeled by our guys a long time ago and we’ve even gone on to release some interesting information in the form of the ‘Data Encryption Toolkit for Mobile PCs,” Hensing wrote on his personal blog.
He cited an official Microsoft document that provides an overview of how Windows Vista’s BitLocker can be used with a TPM (Trusted Platform Module) to mitigate against this attack scenario.