3

Say, for example, you have a laptop with encrypted drives so data can't be pulled from those drives if they are physically removed from the device. If you close the lid of the laptop, thus locking it (presumably being protected with a strong password), and someone steals the laptop, can they pull data from the RAM of the laptop? The device is still running so I would presume that data is kept in RAM when it is locked, and is only lost at power-off. Presumably one would have to gain hardware access to the RAM whilst it is in the running device, but I don't know if this is possible. I would wager a guess that it would require physically modifying the motherboard while in use to tap off of the RAM bus to read from it?

8
  • 3
    "When the device is first unlocked after boot, the drive would be decrypted, so I would assume that even while locked, the drive is still decrypted." The drive is not decrypted when you unlock it. The key is just kept in RAM so that data can be decrypted when you access it. Decrypting the whole drive would take a long time.
    – eesiraed
    Sep 2, 2022 at 23:31
  • 3
    See en.wikipedia.org/wiki/Cold_boot_attack.
    – eesiraed
    Sep 2, 2022 at 23:40
  • @eesiraed "the drive is not decrypted when you unlock it. The key is just kept in RAM so that data can be decrypted when you access it.", Noted! I'll remove that from the post.
    – Kalcifer
    Sep 2, 2022 at 23:59
  • Old tool but quoting for education purposes: Inception - a physical memory manipulation and hacking tool exploiting PCI-based DMA
    – Kate
    Sep 3, 2022 at 19:13
  • @eesiraed the drive would be decrypted? It should be rather that for each read request the necessary parts are decrypted. The derive is never decrypted, the read request are decrypted...
    – kelalaka
    Sep 5, 2022 at 23:26

1 Answer 1

3

Yes! There are several techniques for this.

  • The classic is the "cold-boot attack" mentioned in a comment. The machine is forcibly rebooted to a lightweight OS that doesn't wipe memory on startup, and immediately dumps all data from physical RAM (it generally takes at least a few seconds after power loss for data in RAM to be lost).
  • There's the option of physically accessing the RAM. The most common approach there is to spray the physical modules with a cryogenic liquid, as extreme cold increases unpowered data retention time significantly (up to minutes); the attacker than simply unmounts the RAM and connects it to a device that dumps it to persistent storage.
  • Alternatively, if the RAM pins are exposed, the attacker can connect a device that will keep the RAM powered even after the motherboard loses power, and then cut machine power and access the data directly (this requires more hardware than the other approaches but works even if e.g. the RAM is soldered to the motherboard and the firmware is configured to disallow booting unknown operating systems).

As a general rule, if you're using disk encryption, you should disable suspend-to-RAM (a.k.a. sleep). Suspend-to-disk (hibernate) is fine; the system fully powers off when hibernated so the RAM loses data quickly (and the OS can even deliberately wipe the data as the last step).

There are some mitigations against this. For example, if the data on the RAM is also encrypted using any sort of hardware security module (TPM, Secure Enclave, etc.) that is sensitive to power loss, you might be able to prevent an attacker from obtaining useful data out of the RAM. If the data on the disk is encrypted using an HSM, then the key need not be in (physically accessible) RAM at all. Still, as a general rule, if a device is only locked (at the OS level) / in sleep mode, encryption should not be assumed effective against a sophisticated attacker.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .