Hypothetical: a Windows 7 or 8 computer has a self-encrypting hard drive. It is stolen with the power on, but with the Windows lockscreen on. Are there easy off-the-shelf ways to access the data on the drive? All of the password recovery mechanisms I see for Windows 7/8 appear to require a reboot, which would drop the decryption key from RAM. I'm not concerned with intelligence-agency stuff so much as what would be available to the average petty criminal.

  • Good point, changed question phrasing to "data on". – joseph_morris Feb 27 '15 at 0:28

It simply requires a entry level of electronics knowledge to do this. The average 'petty criminal' wouldn't care since they would simply sell the stolen hardware (also they most likely would not care in the slightest). Your danger would be if your average house-thief was effectively being sub-contracted by someone with a little bit more knowledge/experience and the intent to commit identity fraud or steal your data.

You RAM is going to need to be 'refreshed' every once in a while ( and by that I mean nano-seconds. ) when this occurs the ram is read and written to, and the pins are visible right there.

If DDR ram is cold/frozen then the data contained within a ram chip can actually survive not being refreshed for more than long enough for the ram chip to be removed, and dumped.

Once a full ram-dump occurs then ram can be replaced with a simulator and the machine can be instantly returned to its previous state with the ability to even disable the lock screen ( or alternatively just grab the HDD Decryption keys out.

There are also attacks which can be used to intercept data inline via attaching debuggers ( a lot of Nintendo 3DS / Wii / WiiU research used those techniques for sniffing live ram. )

Your best bet against the first attack I described would be to migrate to a machine which has its ram soldered directly onto its motherboard ( I know for a fact the macbook air does, as do the majority of video game consoles. )

  • So there's no easier way to get past a Windows lock screen than a freezer attack? – joseph_morris Feb 27 '15 at 2:06
  • well the easiest / laziest way to do it would be to exploit window's handling of fat32 drives ( there is a exploit which with a specially crafted drive you can obtain kernel level access by simply plugging a drive in. ) or using the Firewire/DMA exploit to dump all the ram of the machine. End of the day physical access to a machine is usually "game over" . – Damian Nikodem Feb 27 '15 at 2:09
  • There's the fat32 flaw published in MS14-063, but that only pertained to Vista and earlier, and has been patched. Is there another exploit? And are there ports allowing DMA on most PCs? I thought that was a Firewire/Thunderbolt thing -- ports that are on a few PCs, but not the average PC. – joseph_morris Feb 27 '15 at 2:33
  • the fat32 flaw wasn't "completely" patched, as for DMA, DMA is one of the oldest methods of hardware communications, I would say there are at least 10 vectors if not more (the reason why firewire was targeted is because its so fast that its practical to edit ram and not just read it. Any devices that are attached to northbridge would be trivial to attack, and with a little bit more effort southbridge is also vulnerable.) Pretty much all motherboard designs are vulnerable to this style of attack. – Damian Nikodem Feb 27 '15 at 2:41
  • Can you estimate the likelyhood of success of the freezer attack? Isn't there some chance that the information on the DRAM will be partially lost before dumping? What hardware do you use to dump? – hft Feb 27 '15 at 2:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.