[CoLoCo] researchers cracked Microsoft's BitLocker, Apple's FileVault and Linux's dm-crypt

[Neal McBurnett]

On Thu, Feb 28, 2008 at 10:56:12AM -0700, Dave Vanderploeg wrote:
> I read about this the other day, and I had a few thoughts. Maybe its time to
> encrypt RAM? Maybe do a quick scramble of the ram when a computer shuts down
> (though this does nothing if a computer is on an they just pull the power
> source). I'm sure someone smarter than me will figure something out.

The problem with encrypting RAM is where do you store the key?  If
someone comes up with some new hardware that can more safely store the
key, ok.  But "Today's Trusted Computing hardware does not seem to
help; for example, we can defeat BitLocker despite its use of a
Trusted Platform Module."  That surprises me....

 "There's not much they can do at this point," Halderman says. "In the
 short term, they can warn their customers about the vulnerability and
 tell them to shut their computers down completely when traveling."

 In the longer term, Halderman said new technologies may need to be
 designed that do not require the storing of encryption keys in the
 RAM, given its inherent vulnerability. The researchers plan to
 continue investigating this and other defenses against this new
 security threat.

Fascinating - thanks for the link!

-Neal

> On Thu, Feb 28, 2008 at 10:45 AM, Andrew <keen101 at gmail.com> wrote:
> 
>     Thought this might be of interest to someone...
> 
> 
>     http://www.rdmag.com/ShowPR.aspx?PUBCODE=014&ACCT=1400000100&ISSUE=0802&
>     RELTYPE=SOFT&PRODCODE=0000000&PRODLETT=IL&CommonCount=0