The Channel logo


By | Cade Metz 22nd February 2008 02:03

Security boffins unveil BitUnlocker

Disk encryption decrypted

BitLocker, meet BitUnlocker.

Word arrives from The Electronic Frontier Foundation that a crack team of researchers - including the Foundation's own Seth Schoen - have discovered a gaping security flaw in everyday disk encryption technologies, including Microsoft's BitLocker as well as TrueCrypt, dm-crypt, and Apple's FileVault.

If a machine is screen-locked or left in sleep or hibernation mode, Schoen and his cohorts proclaim, an attacker can circumvent disk encryption simply by powering the machine down and quickly re-booting to an external hard drive.

You see, DRAM tends to retain data for up to a minute after power down. When a sleeping machine is "cold booted," its encryption keys stay right there in memory - and they're ripe for the taking.

So, sleeping machines are vulnerable even if they're left alone for a matter of minutes. "Let's say you're in a coffee shop and you leave your Vista notebook screen-locked and tied to a table while you take a trip to the bathroom," researcher Jacob Appelbaum told The Reg. "All I would have to do is force a reboot to a USB drive running our custom software, and I could work around BitLocker."

Yes, their custom software is called BitUnlocker. You can see it in action here.

With certain types of DRAM, a simple cold boot won't do the trick. Data fades too quickly after power down. But Appelbaum and company have also shown that retention rates can be extended by quickly cooling the memory. All they have to do is open up the machine and spray on a little canned air.

What if BitLocker is used in tandem with a TPM (trust platform module) security chip? According to Applebaum, this could mean the machine is even more vulnerable to an UnBitLocker attack. "When a machine boots, it immediately takes the encryption keys out of the TPM," he says, "and puts them into memory." In other words, when there's a TPM in place, Appelbaum can pull his trick on a machine that's already been powered off.

When we say gaping, we mean gaping. ®


Originally, our article said that researchers put the freeze on RAM by spraying liquid nitrogen. Liquid nitrogen was used in some tests, but not in this way.

comment icon Read 73 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe