Can you extract memory contents from a hibernated Windows machine?

Question

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk.

When Windows hibernates, it puts the contents of RAM to a file on disk (and maybe other stuff too, I don't know) and then turns off. When it turns back on, I'm assuming, it pops the saved RAM contents on to the actual RAM itself.

So a hypothetical attack would be to either steal the saved disk file, thereby stealing RAM contents, which may include sensitive data such as passwords, or do a memory corruption by changing the RAM contents, by adding/editing instructions so that arbitrary code is executed.

Now, I know that an attacker having physical access to a machine can do just about anything, but taking these specific attacks into consideration, is this at all possible? Assuming there is no disk-wide encryption, does Windows actually encrypt the saved RAM when it hibernates?

Also, does anyone know where this file will be stored? So that, I can try hands-on to view contents of the disk, maybe using a LiveCD?

Answer 1

Yes, it does store it unencrypted on the disk. It's a hidden file at C:\hiberfil.sys, which will always be created on any system that has hibernation enabled. The contents are compressed using the Xpress algorithm, the documentation of which is available as a Word document from Microsoft. Matthieu Suiche did a comprehensive analysis of it as a BlackHat presentation in 2008, which you can get as a PDF. There's also a tool called MoonSols Windows Memory Toolkit that allows you to dump the contents of the file. I don't know if it lets you convert back, though. You might have to work on a way to do it yourself.

Once you've got the data out, it's possible to extract or modify data, including instructions. In terms of mitigation, your best solution is to use full-disk encryption like BitLocker or TrueCrypt.

Answer 2

It is possible to access the content of a hibernation image simply by booting the computer, which resumes the image. This is after all the whole point of hibernation. If resuming does not require any secret, it means the hibernation image is self-contained, there cannot be any protection against an attacker accessing it since there is no way to distinguish an attacker from a legitimate user.

Resuming may not provide access to everything, e.g. if you get back to a screen unlock prompt. Making a copy of the hibernation image will let you boot it multiple times. You may even try to boot it in a virtual machine, though you'd have to emulate the original hardware pretty closely in order for the restoration to succeed.

Of course, the best way of accessing the data that's been written to the hibernation image is to read it without executing it (Polynomial's answer has pointers to the documentation of the format).

It is possible in principle to encrypt the hibernation image, but that requires a user interface change: someone has to enter the decryption key upon resume (usually by typing a passphrase, or e.g. by inserting a smartcard). As far as I know, Windows doesn't support encryption of the hibernation file, even with Bitlocker (the FAQ is ambiguous, this article claims the absence of such a feature). TrueCrypt does support encryption of the hibernation file, as do Linux's hibernation and disk encryption mechanism.

Note that an encrypted hibernation image is useless for an attacker who steals the disk, but it doesn't defend against an evil maid attack, where someone has access to the hibernated system and can plant malware in the boot image which will be activated when a legitimate user next comes along and enters the passphrase. Defending against such attacks requires verifying the integrity of the bootloader (including the resume facility) − this is no different from attacking the cold boot of a system.

Answer 3

Such attacks are possible. The name of the file is "hiberfil.sys", located in the root of the windows partition. The location can be changed. Windows does not encrypt hibernation nor swap (pagefile.sys) file. To avoid this kind of offline attack, full disk encryption (of system drive and drive storing the hiberfil.sys and pagefile.sys if their locations have been changed) should be used.