0

Background: I'm trying to get as much security as possible. I have my hard drive encrypted with BitLocker, but I got worried about leaking something through RAM. Precisely, if someone gets to my laptop when it's turned on but locked, they could still retrieve some data from it's RAM by some cold boot procedure. As far as I know, encrypting RAM is not possible on Windows, so I thought of wiping the unused portion of it in order to limit what might get leaked.

Question: Is there a Windows command (or feature, or utility) that would wipe unused portion of RAM (without shutting down of course)?

1
  • Not as such, but you can try RAMBooster. It just allocates memory until the swapping out gets heavy, then frees it all of a sudden. This in theory increases available RAM (in practice, meh). But in so doing, it also inevitably makes Windows scrub that same memory.
    – LSerni
    Feb 27 '20 at 19:50
0

You are looking at a workaround or a mitigation of this risk at best. There are no official tools that provide this functionality, and a cold boot attack is relatively difficult to pull off. The RAMBooster approach suggested in the comments will flush your data to the pagefile, which, ironically, can make that data easier to recover if the attacker retrieves your Bitlocker key. Cold boot attacks may not be able to retrieve all memory contents due to the decay that occurs after power loss, but the pagefile does not decay in the same fashion.

That is bad because the Bitlocker key could be retrieved by multiple means. One is the cold boot attack you're worried about (which is quite difficult to achieve, and a failed attempt will result in the permanent loss of volatile memory). Another method is somewhat easier, cheaper, less noticeable, and repeatable: DMA attacks.

The safest course of action is to either power down the machine or enable hibernation when the machine is unattended. Powering down is the safest option, but it is disruptive and therefore impractical.

Hibernation is an acceptable mitigation in this case because the contents of RAM are written to disk, and then the system is powered off; this starts the clock on DRAM. Most other power/sleep states leave RAM powered on and refreshing, so be careful when configuring the system. Since you must unlock the disk before RAM contents can be restored on the next boot, you will have to endure a regular bootup, but your applications will resume in the same state you left them in.

Off and warm is good. The contents of DRAM decay faster when the memory modules are warmer. Under ideal circumstances, an attacker would freeze the memory immediately after shutdown to maximize the likelihood of recovery. This implies that it is best to power down the system before it comes under adversary control, as memory contents last for maybe 30-60 seconds at normal temperatures. Note that the article tests DDR2 memory, and newer types are expected to exhibit lower remanence; a later study was able to reproduce the original results with DDR2 but could not retrieve data from DDR3 using the same method.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.