Once Again Physical Security Trumps Everything
If you ever heard the the old adage that “If the attacker has your machine, it is no longer yours” it still rings true today.
Even though there have been many advances in protecting data once it falls into the hands of an attacker, someone will find a way to break in. This has been shown to be true again. Researchers Heat Up Cold-Boot Attack That Works on All Laptops
Cold Booting attacks have been around for a while, and the name is derived from the original method of getting information. With a traditional Cold Boot attack you can turn off the machine, put the machine in sleep or hibernate mode, and dump the memory. One method involves using canned air to freeze the memory, then pull the disk image from the memory. When a computer goes to sleep it basically will save the system “state”. What this means is that this state can be recovered, and the entire running system will be accessible as if the computer had been unlocked (or never locked).
Recently with the implementation of BitLocker it is possible to protect the area by making BIOS changes, through pre-boot methods of verification, as well as using volume encryption. (Although FireWire still is an issue due to the transmission standard).
This new method allows someone to configure a micro-controller (basically a circuit board with programmable instructions) to act as an intermediary between the rewrite instructions, and the where the encryption keys are stored.
Using the encryption keys allows the attacker to unlock BitLocker and any encrypted drives/data, or plant a backdoor and use the trusted device/user to gain VPN access, and use the device as a pivot.
Luckily hibernation is not vulnerable, the reason for this is that when hibernating BitLocker will encrypt the system state (similar to post shutdown/preboot). The drive data can be recovered, but it would not contain any of the encryption keys to make sense of the data.
BitLocker has gone through a lot of improvements, there used to be MBR exploits which were pretty easy to use to bypass BitLocker and today the traditional ways of pulling keys or images of running systems is harder due to OS integration and pre-boot settings. The bad thing/good thing about hardware is there is always a way to bypass it. That means the only thing you can hope to do is add complexity, and unfortunately obfuscation does not equal secure.
