After reading some research papers about cold boot attack, I got a big shock and start searching for ways to protect against that kind of vulnerability. I got one solution that is using BitLocker pin access to RAM. But I have still a concern.
Windows 10 Latest patch can protect cold boot attack?
No.
DDR3 or DDR4 RAM still have vulnerability?
DDR3 and DDR4 retain memory for a shorter period of time than DDR2, but cold boots are still possible. DDR4 additionally uses memory scrambling (for purposes of electrical reliability), but the scrambling algorithm, which is an LFSR, is not designed for security and can be broken.
Is there another way to protect rather than BitLocker pin?
A BitLocker pin does not protect from cold boot attacks.
Some modern AMD CPUs support full and transparent memory encryption called SME and branded as "Memory Guard". I don't know if you can enable the full memory encryption from Windows. Other than that, all you can really do is use physical security. Use strong encryption, and always turn off your computer before you leave it unattended. As long as you are with your computer for a few seconds after it has powered down, the chances of recovering any memory quickly becomes nil.
The idea of a coldboot attack is to freeze the RAM while the operating system is still running (for example whilst you are on lunch break and your box is running but the screenlocker is enabled). This results in the RAM not loosing the data even if it looses power. An attacker can then reboot the device using his own operating system and extract any data from the RAM he desires. Most interesting is usually the cryptographic key used to decrypt the harddrive. This can then be used by the attacker to decrypt your harddrive and access any data he likes.
For a successful attack, the attacker needs all of these to apply:
1.) Your operating system cannot access the data stored on your harddrive without the cryptographic key to decrypt it. This key needs to be stored in the RAM, you cannot avoid it. The only way to work around this is to shut down your computer whenever you leave.
2.) You can work around this by applying physical security measures such as tamper switches that wipe your RAM if the case is open. This might help against some attackers but a well prepared attacker that knows about the measures you applied will find a way to circumvent them.
3.) You could use a BIOS /UEFI that wipes your RAM as soon as your computer is turned on. An attacker would need to take out your RAM in order to read it out externally. Maybe you are able to apply physical protection against this, but a well prepared attacker will find a way to circumvent this, too.
In the end I think you should think about your threat model. Which attackers are actually relevant to you and your scenario? Is this actually the easiest way to get access to your data? Also remember the xkcd ;-)
I believe that implementing something like TRESOR, which involves storing an AES decryption key in CPU registers, would be the only possible way of mitigating a cold boot attack in software, but I'm not sure what the implications (performance or compatibility with existing programs) are for typical Linux systems. In the paper, TRESOR appears to dedicate debug registers to the encryption key, so it's possible that various debugging tools would fail to run correctly.
The original paper notes some potential attack vectors, but most of them are either not "cold boot" attacks or would be significantly harder to execute than a regular cold boot attack on RAM.
For hardware mitigations, because cold boot attacks require reading from the computer memory after a reset or hardware swap, it may be sufficient to implement a RAM-scrub and shutdown on chassis intrusion paired with physical barriers to make it harder to freeze and remove memory. Blocking access to ports to prevent changing the boot device without chassis intrusion would also be a requirement in this case.
AESKEYGENASSIST show the least performance hit. Also you'd want to patch TRESOR so NMIs and SMIs are disabled, otherwise you may find the keys being pushed to RAM from time to time.
Considering specifically the variant of a cold boot attack where an attacker disconnects memory modules from a victim's computer and connects them to the attacker's computer, one way to protect from this attack is to use memory chips that clear their contents when powered up.
Considering a wider range of attacks when an attacker supplies power to memory modules while transferring them or reads electrical signals from memory module contacts, one way to protect from these attacks is an intrusion detection system which clears memory contents when the case of the computer is opened.
Unfortunately, all these protection methods requires non-standard hardware.
How about TPM + Veracrypt (or any other)? That should do the trick. Rowhammer effect can't be fully mitigated for now.
