-1

From a security point of view, is sleep safer than shutdown in laptops? Shutdown only needs to be done after monthly updates, since shutdown "saves" settings, "changes" etc, then reboots. Sleep only saves session & then enters low-state mode. In Windows 10 Pro

  • I removed the section about power management. – schroeder Dec 11 '17 at 11:59
  • 6
    What security are you thinking about? What threats are you thinking about? – schroeder Dec 11 '17 at 12:01
  • It depends on your threat model. It very well may be less secure due to keeping keys and other secrets in RAM. When waking from sleep mode, ACPI tables are re-read (AML bytecode is fed through the interpreter), which means if the BIOS is modified while the device is sleeping, a compromise can still take effect when it wakes from sleep. But since I have no idea what your threat model is, I can't even tell if that's relevant to you. – forest Dec 11 '17 at 12:48
2

The answer depends on your threat model. Whether sleep or shutdown is better in your specific situation depends on many factors. Without further information, this is the best I can do.

Suspended

There are four types of suspension (sleep) defined by ACPI, from S1 to S4.

  • S1 - The CPU cache is flushed and the CPU halts. Also called Power on Suspend.
  • S2 - Dirty processor cache is flushed to RAM, and the CPU powers off.
  • S3 - Only RAM and necessary subsystems are powered. Also called Suspend to RAM.
  • S4 - RAM is saved to disk and the system powers off. Also called Suspend to Disk.

Typical "sleep" or stand-by mode on a modern computer is S3, so I'll assume that is what you're talking about. When memory remains powered on, all its contents are saved, including potentially sensitive information like passwords or encryption keys. This can make the system more vulnerable to a cold boot attack or DMA attack. This is only an issue if your threat model involves passive retrieval of the contents of memory for an attacker with physical access.

There is another thing to remember with S3 sleep. When a system is powered on, or when a system resumes from stand-by, it re-reads the ACPI tables, executing AML bytecode. This is executable data stored in your BIOS and executed by your system's kernel. As a result, a system whose BIOS has been modified to contain malicious ACPI tables will be executed either when a system powers on, or when it resumes from stand-by. If your threat model involves tampering with your system while it is still online, stand-by will not necessarily delay the onset of the attack.

Powered off

When the system is powered off, all power to all subsystems is cut. When the system is powered back on, the BIOS and disk are re-read. Any changes to either the BIOS or disk will affect the system at this time. Solutions like BootGuard are required to provide integrity and avoid this outcome.

If the hard drive is stolen, all the data present on it can be read. To avoid this, you should use full disk encryption, for example by using VeraCrypt or Bitlocker. When this is done, your system has data at rest security. Any data sitting on your hard drive will be unreadable without the proper key. Bitlocker can further tie this to your physical computer by using its TPM, ensuring that removing the hard drive and knowing the key isn't sufficient to obtain the contents.

When a system is powered off, the volatile state of the computer is lost. This will kill any memory-resident malware, although that type of malware is not that common anyway. This behavior is, however, useful for getting rid of many bugs that accumulate as uptime grows. In these cases, turning it off and on again really does work. A full reboot to a computer is like a good night's sleep.

Threat modeling

I am assuming your threat model involves attackers obtaining information from your computer one way or another, rather than accounting for more esoteric attacks like live modification of the ACPI tables on a suspended machine. If this is the case, you probably simply want to ensure all your data remains confidential. The answer for that threat model is that shutdown is "safer". There are a few things you should do:

  • Power off your system when you are not using it to avoid leaving secrets in memory.
  • Use full disk encryption to ensure data at rest security.
  • Use hardware with BootGuard to verify integrity of your firmware.
3

No, sleep is less secure. In sleep the RAM remains powered up, and it is very likely that encryption keys and passwords will be stored in RAM. This can either be recovered via debugging channels, such RAM dumping via Firewire, or even rebooting the computer and dumping RAM, as it takes time for the content to leak out of RAM.

So in short, it's a lot more secure to have the computer totally powered down - especially if combined with full drive encryption.

0

Vidarlo is correct that sleep (suspend-to-RAM) is less secure because it tends to leave secrets like encryption keys in RAM and those secrets can be recovered by an attacker with physical access. With that said, if you use full-volume encryption (on Windows, typically BitLocker), then hibernate (suspend-to-disk) is also secure. Secrets will either be lost and need to be re-entered or otherwise acquired (for example, the disk encryption key from a passphrase / TPM / etc.) or will be stored in the (encrypted) disk (in the hibernation data).

In fact, if you have full-volume (or disk) encryption enabled, and you want maximum security, you should disable sleep (suspend-to-RAM) and force hibernate whenever, for example, a laptop's lid is closed or the machine is left unattended for a while. This substantially reduces the risk of an attacker getting physical access to a device while its disk encryption keys are still present in RAM (and therefore recoverable). You can also use a tool like YoNTMA (You'll Never Take Me Alive, for Windows or Mac) that will automatically hibernate your machine if it is running but locked and gets removed from its current location (for example, because a thief walked off with it). YoNTMA will also disable sleep mode for you, at least on Mac, and force the machine to hibernate instead.

(Disclosure: I used to work for iSEC Partners, the company that developed YoNTMA, but was not associated with the project.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.