I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description:

  1. What do it mean by operating system that allow booting to the other.
  2. Why OS has to make sure that the system pagefile is wiped clean when its shuts down.
  3. How can a unauthorized user can get direct access to the pagefile.

“Systems that are configured to allow booting to other operating systems” encompass two situations:

  • A computer with dual boot between two operating systems (e.g. Windows 2003 and Windows 8, or Windows 2003 and Linux) where the two operating systems have different user databases, and in particular different groups of people have administrative access. An administrator on OS 1 can read the swap from OS 2. This is of limited impact as the administrator on OS 1 can also read the data from OS 2, but it does mean that data which was accessed from OS 2 and never explicitly saved to disk is at risk.
  • A computer (typically a laptop) which is stolen by an attacker while powered off, or a computer whose hard disk is stolen by an attacker. The attacker has access to the storage medium unfettered so can read all the data on the disk.

Wiping the swap area on shutdown ensures that any data that wasn't explicitly saved to disk, will be properly erased after a clean shutdown. Data can end up on the disk implicitly due to swapping. Note that in practice, data can end up on disk for other reasons due to application design, e.g. temporary files, print and mail spools, browser cache, …

Wiping the swap on clean shutdown is of limited impact, because in some scenarios (e.g. attacker stealing a running laptop) you cannot rely on a clean shutdown. Some Linux distributions encrypt the swap area with a random key which changes at each boot (I have no idea if Windows can do this). This doesn't protect against warm boot attacks where the attacker can dump the content of the RAM, nor against sensitive data left in files.

| improve this answer | |

One attack vector is to boot from another OS via a thumb drive (physical access to the drive would be another). The Windows OS treats the pagefile section of the hard drive as if it were dymanic RAM memory which is lost at shutdown. Accordingly, until this feature, valuable information from the last running session might be unprotected on the hard drive in that area if the system were started from a thumb drive.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.