Eh I am more worried about bios attacks. An attacker stealing or tampering with a laptop while in a public place and putting a sniffer which will capture the key on boot.
Kennedy Assassination .doc file and Social Security Numbers .xls and there in the "Secret Files" folder @4:22 What secrets will now be revealed thanks to the encryption key being beaten. But in all seriousness yes these keys in ram can easily be obtained and yes the the cooling of ram will make it readable for a longer period of time.
Another nice (and easy to do) thing would just be ordering the machine to write all the bits in ram to 0 or 1 or so when it's ordered to shutdown. (Any Linux distro -> Very very easy, Windows -> can't tell, OS X -> can't tell.)
@EUBG your an idiot... sure it could write 0's/random data on shutdown but if you f*cking pulled the plug/battery than that wont work..... you can just buy extra hardware for you computer that surges the ram with a internal battery when a voltage drop is detected or a shutdown... all else just turn off when done...
Truecrypt is vunerable, she said *probably* vunerable. When you enter the password on it is stored in the RAM memory. After the header is unencrypted the real encryption keys are read to the RAM memory like the password so data can be unencrypted. While the file/hd is mounted you can apply this type of attack. But once you unmount it truecrypt wipe the memory for those informations and this attack is *probably* not valid.
That is true, however when the computer is abruptly shut down, (by removing the battery, as mentioned in the video) then the program is not able to wipe the memory.
@Evi1M4chine Did you even watch this video? It doesn't matter if computer does or does NOT boot from an external disc, since you can cool the RAM module and plug it to another system, and dump its contents from there. -.-
@Evi1M4chine without knowing TC specifically I'd still say it has to store the key in RAM in some form because it needs it all the time for en-/decrypting data as it is being written to/read from the physical disk. It may just not store the key in a continuous RAM region, which would make reading it a bit more difficult, but not impossible if this bitunlocker thing has specific knowledge about how TC stores the key.
@Evi1M4chine Can you or anyone of your supporters prove that statement? Fixed? No. At least their documentation still says today: “Inherently, unencrypted master keys have to be stored in RAM too..”
This will not be subject to change – it is simply not possible without using a TPM.
Even if is not, is stupid, prove you can dump an encryption key with a residual image of the joconde.
If any letter or symbol or number is missing on the data file of encryption key it isnt work, all the blanc data need to be brute-forced. If you have more than 20 blank in the key code the probleme is the same has a long password, you need a supercomputer and some years to break it.
NO you retards! The computer does NOT boot from the external hard disk. Except if you were just as retarded, by actually configuring that (or leaving it configured that way, which is the same.) in the BIOS.
And you know this EXACTLY. So youre deliberately lying, to make a point that does not exist for those who really care for their security. (As opposed to those who just leave encryption on by default, because they dont care enough to change anything at all.)
It is possible to create a program on a DVD, insert it, and boot from that DVD. If you want to save your computer in case of a crash, you *MUST* be able to boot from a DVD before your harddisk drive.
So, you can configure the program on the DVD (just like the Norton Ghost wizard) to boot up, and copy/crack/whatever.
This is of course only needed if the eks. HDD boot option is bellow the primary harddisk.
Authorities in charge of security (U.S. Military Intelligence) assert that all data in commercial RAM instantly disappears as soon as power is cut off. For example, when RAM is unplugged from computer, as demonstrated in this video. This video exposes that myth and shows most security regs and SOPs as most inadequate.
dude...thats not how a commercial ram works...not that i want to defend this video, but what is mentionned with the picture in the video is actually right. Its because of the way the ram is made (the comparators and the flip-flops composing the ram are loosing their power gradually, so afterimages of what was there stays for a short time).
next time, try to know a liitle bit more on the subject before saying that something is ''inadequate''
What kind of "expert" would think volatile memory is magically wiped as soon as power is lost? Other than an "expert" in the Microsoft-bubble sense of the word..
Nobody in the real world of computing would trust that SDRAM module content is gone until it had been explicitly overwritten.. several times (multiple passes for those paranoid enough to think some quantum physics forensic techniques could detect previous states).
I think this can be prevented by turning of autorun on external devices, like that external USB HDD, and by removing anything but the internal HDD from boot order + protect that with bios password(though with removing motherboard battery, that pass can easily be erased)
Truecrypt also mentions this attack in its documentation and says with cooled ram, memory can stay intact for several hours, but with some new types of memory modules it is only 2.5 seconds.
I think my Acer Aspire One [AOA150] is Well protected, if the data don´t dissapear on all the fucking time it need to get to the Ram Slot, then maybe the key is stored on the 512 Soldered Ram that come in the Motherboard.
NOBODY CAN HACK MY BOX! I store all my sensitive data on a stand alone usb drive that has 128 bit AES hardware encryption on it and cycles keys whenever I backup, which means not only does this thing have government grade encryption but it also stores all the keys on the drive itself which has no RAM and you cannot access the drive without the 30 character alpha-numberic password that I change every 15 days...
Not only will a keylogger not do you any good because the box is not online, I use a hardware firewall, software firewall, as well as an encrypted net connection... Even my logitech keyboard has it's own encryption designed to prevent keystroke detection attacks.. bottom line > UNHACKABLE!
My encrypted keyboard alone would stop the keylogger. And you would have to find out where I lived to get physical access, considering you do not have my ip, that is impossible for YOU to accomplish.
Software loggers are very simple in design in order to remain undetected. An encrypted usb keyboard would not be susceptible to these loggers which usually monitor bus or irq, You would need a more advanced logger that monitors USB communication and can crack the encryption scheme. I'm not saying it's impossible, im just saying the simple loggers out there cannot do it. And using a more advanced logger would mean going further up the operating system and make you more vulnerable to detection.
At the end of the day though, this isn't going to stop any keylogger polling the WinAPI for key events.
Every application does this and you can't really distinguish malicious and non-malicious lookups of this table due to the fact most if not all applications poll a vast array of key events.
And like BioSlayer said: Physical Access == Comprimised
I agree and I have stated before that my box is vulnerable to physical attacks, the chances of a physical break in combined with an individual who is able to bypass my security is very remote considering the vast majority of people who commit such breaking and entering don't have the knowledge nor the education to perform such tasks.
Unless of course one of you find out where I live =)
just press enter when startup and chose which you want to boot from, even if you set password in bios you can clear it by the ClearCMos buttn at the motherboard
Technically Yes, but if they have access to your computer they could easily flash the bios, by moving jumpers around and wipe all existing passwords on your motherboard.
No, look up how a transistor works. Also, the CPU has a cache, specifically for that. The memory is a little different. I think I head an analogy before about it. The space right in fron of you on your desk is the cache, and the drawers to your side are the memory.
first off there are better ways to get full access, some taking about 5minz. And for all of you who keep data like this on your lappys i hope this happens to you for being stupid enuff to keep data like that on there.
haha :P im protected, since i set my keys to be uset in hdd (i set 300mb of it to be used as ram) and i locked the boot process from only my hdd, no other external devices (usb, cd/dvd, floppy,fire wire, etc.)will be run while booting, so there is no possible way on hacking my pc :P
No, just remove your RAM and break it. Or take a lighter to it (heating the RAM will have the opposite effect of cooling it, and of course melting = breaking :)
just turn off your pc/laptop whenever you wont use it or theres people you dont know near, when PC turns off (no energy) RAM DATA gets erased, if you manage to get the data of the RAM after turned off , you are pretty fast..
Didn't the presentation conclude saying that other encryption technologies on other operating systems were as vulnerable? This attack has nothing to do with Windows specifically.
lesson learned is that ure ignorant to the highest degree
u do realize that mac's also use the same or nearly the same encryption algorithms and methods right? and u do also realize there are memory cards in mac's too? linux may be safer because it is open source but that doesnt guarantee safety either. these techniques can oft be pulled off on any systems if not all the time.
another thing
a common saying for macs: security through obscurity
I have a question. So you turn off the computer with the external hard disk plugged in, and it automatically takes the remaining RAM. But they have like a software in the disk. I want htat software xD
This comment has received too many negative votesshow
i blocked it with my special boot modifying software, if it runs from somewhere, the whole external storage device gets scrambled with a worm specially designed by me :P muhuhahaha!
Even a very strong magnet will not do a very good job of permanently wiping a drive. And even if it did, the downside to this is that you destroy your hard drive and lose the data in the process.
You lost the benefit of encryption - that you are still able to access the data but someone else can't, even if they have physical access to whatever it resides on.
Interesting. I wonder how the ATA disk security ("hard disk password") would come into play here.
Whenever my computer is turned on or wakes from sleep, I have it set in such a way that a password is needed to access the disk. This is hardware (written to the disk itself), and not stored in RAM. Once this is entered, the computer presents the normal login screen.
While surely less secure in many ways than encryption, I wonder if it'd be an easy and practical means of countering this attack.
If the computer is stolen while the computer is on, it may still be vulnerable, because the hard disk will still have the decrypt key in its memory. Whether you would be able to freeze and remove the hard drive and then 'hot-swap' it into another system to access like nothing happened, I don't know. I imagine it would be possible but difficult.
MCBathtub... you crack me up man, talking like your a computer 'expert'. If you really knew your shit you would know that RAM consists of silicon wafer arrays that, believe it or not, CAN HOLD DATA after power is removed. Granted they need to be extremely cold. Point B, electricity doesn't use itself up, when the ram chip is unplugged from the computer their is no place for the negative electrons to travel, so they sit in the silicon for a small amount of time. Stop embarrassing yourself kthx
I don't know if anyone mentioned this already, but why the switch from the Vista to Ubuntu box during the demo? Is it booting into Ubuntu from the external HDD? (Around 3:50)
But if it's mounted when you /physically/ steal the computer, or are at the login password prompt (and the disk is mounted as a system disk would be) when you /cut the power/ to use these techniques, the key is still in memory and vulnerable to these attack methods.
lmao, a 21 year electrical engineer who 'knows'... come on. Maybe if you would TRY what these people are suggesting, you would find that common literature makes assumptions about this technology that are INCORRECT.
Very interesting concept. Trabant6666, go fuck a tree and learn some computer science before you go trashing peoples work. I guess you don't understand the concept of DUMPING the contents of memory to disk for viewing. Take an A+ class before you decide to make a hateful post kthx.
this is stupid and impractical, even single bit from the encryption key (with your stupic error correction) "faded" in ram and you're method is fucked up bitches
Very interesting. But I don't think this is a software problem. And changing the encryption software would not completely solve it. The encryption software must store the key in memory. If you can somehow read the memory while the key is there, you break it.
Even if this attack were viable, the problem is not with the software. Leaving secure drives mounted when you are not physically at the computer is where the fault lies.
Truecrypt has a simple solution for this, just check the "Auto-dismount when entering power saving mode" option. Now when you put the computer to sleep the keys are erased.
So what this video is basically saying is that your data is safer if you don't use any encryption at all. Furthermore, it's probably not a bad idea to hold a lit match or lighter above your memory chips each time you shut down your computer to make sure the memory fade faster. These are great tips! Thanks for making the video!
Where did you hear that? Capacitors can hold charge for minutes or hours, depending largely on their construction and insulator. Even a relatively simple glass and metal capacitor can hold a charge for several minutes.
Wtf are you talking about? You think the capacitors in RAM can hold their charge for minutes? Not only is a second a LONG TIME, it's more like 100ms...at best.
so if you always shut your computer down, and you have the option to put in the security key every time the computer boots up, you're safe. That's what I got out of that video.
Ah so computer manufactures should wipe the memory with their bios. Bios hackers can easily add this feature. What about when the bios does a memory check is it not writing zeros and ones at this time?
ya. proly the best solution is a self destruct mechanism which will explode the drive if a second key is not entered within 15 seconds of auth. I'm just waiting for MS to add this to the next service pak. short of that... don't store your porn on hard disk, store it on youtube.
What about gluing the ram into the notebook / onto the mainboard so that it can't be removed without destroying everything? Boot from external media (others than the internal hdd) can be disabled, too.
Then, something like that won't be possible that easily ;)
This is assuming a) The laptop is set to boot via USB(which is VERY rare), b) The laptop has slow-clearing memory, c) The attacker has physical access to the laptop straight after someone has shut it down. d) The victim won't be surprised to see that his perfectly fine laptop has lost its power somehow and reset and has white frothy crap all over it. e) The attacker will be able to access the laptop a second time.
It's absolutely impractical. Use a keylogger, social engineering etc instead.
social engineering is a hacking method that tries to guess passwords based on your personality. they would observe you, try to get information of your life, such as names and birthdates of wife/hubbie, kids, pets, etc., and use those and variants of them as guessed passwords.
Even without DRAM recovery, most disk encryption packages are subject to password breaking dictionary attacks as long as you have physical access to the device. Most users passwords contain 18 bits or so of entropy, so rather trival to dictionary attack.
There is a VERY simple way to prevent this from being and issue on many systems. Set a BIOS password that is required both to boot the machine and to change settings like the boot order. Then simply make sure the machine is not set to boot from a USB drive. As for pulling out the RAM, that can't be completely prevented but some epoxy holding the RAM in should make sure it can't be taken out intact while it still contains data.
An application that simply zeroed all ram during shutdown and erased any password fields on disk would solve it. People wouldn't be able to use sleep mode, suspend or leave it long enough for the password screen to be sitting there, but it could be worth it. Also don't turn your back on your computer, lol.
This comment has received too many negative votesshow
You people are terrorist. Stealing laptops and personal information, and even making videos to show other people how to do it. I hope you die in your sleep
No. The point is power down your lap top when you are done, rather than using sleep mode, IF you are are depending on encryption to protect the contents of your files from prying eyes.
If anyone is still worried here is a few tips and suggestions:
The software is made by this organization, not an everyday criminal.
If your paranoid over your information getting stolen go check out Absolute software, They'll install a chip in your laptop that will remotely destroy the hard drives information and can recover the laptop through GPS. So even if they crack the encryption on the hard drive there will be nothing on it.
I think you'd look awfully suspicious sitting next to a computer with the back open hosing down the RAM with an aerosol can.
AngryC4t 4 months ago
Mac OS X never offered full disk encryption. OS X 10.7 (Lion) does. Just an FYI...
donmontalvo1 6 months ago
i want to sex the mouth of the woman who narrates
MsReefmaster 7 months ago
Anyone who carelessly leaves their laptop laying around is an idiot and deserves to lose it!
nosajj12345 7 months ago 3
Why go through all this trouble? Bill Gates and Steve Jobs gave the feds a back door years ago for maybe a few $million.
Use Linux, TrueCrypt and BleachBit.
kh2hbTV 8 months ago 3
Wonderful job, folks :
youwouldbetterfuckme 10 months ago
This has been flagged as spam show
Low cost marriage service for you rockmycity.info
ghfjtyufghdfj 11 months ago
P=NP solution! Give me!!
annelics 1 year ago
Eh I am more worried about bios attacks. An attacker stealing or tampering with a laptop while in a public place and putting a sniffer which will capture the key on boot.
SixBreed2 1 year ago
two words, hardware keylogger.
LemonPieLoL 1 year ago
knife to throat my work
crs2029 1 year ago
wait..if they already have your laptop why dont they just take it with them?
bluecoloredjellybean 1 year ago
Kennedy Assassination .doc file and Social Security Numbers .xls and there in the "Secret Files" folder @4:22 What secrets will now be revealed thanks to the encryption key being beaten. But in all seriousness yes these keys in ram can easily be obtained and yes the the cooling of ram will make it readable for a longer period of time.
FFXIshibaa 1 year ago
ZOMG, so you like totally "freeze" the RAM?
That's freaking amazing, I never thought of that!!!!!!
I LOLed BTW, thanks for the laugh.
willieb76 1 year ago
How hard is it to flush the memory during shutdown? Or is it only when power is cut that the data remains in memory.
jimmayl1 1 year ago
Well, after that i'd say:
When the police stands in front of your door, shut the PC down.
Take your time, do something for at least 2 Minutes and the RAM is empty. - Safe -
TheWanAntOnly 1 year ago 11
@TheWanAntOnly
Another nice (and easy to do) thing would just be ordering the machine to write all the bits in ram to 0 or 1 or so when it's ordered to shutdown. (Any Linux distro -> Very very easy, Windows -> can't tell, OS X -> can't tell.)
Wouldn't be hard to accomplish... :'D
EUBG 7 months ago
@EUBG your an idiot... sure it could write 0's/random data on shutdown but if you f*cking pulled the plug/battery than that wont work..... you can just buy extra hardware for you computer that surges the ram with a internal battery when a voltage drop is detected or a shutdown... all else just turn off when done...
BigSwinginDjick 3 months ago
what great video, too much intersting
tomadetodo 1 year ago
Always turn your computer off... not sleep or standby... just off.
itcanbecheezcaketime 1 year ago
Self-encrypting hard drives are the only defense from this and other attack such Evil Maid.
apaial34 1 year ago
OMG H4X!
TurboRonin83 1 year ago
The 'Evil Maid' attack is a far simpler (and proven) method of gaining a Truecrypt password.
apaial34 1 year ago
Check out my swell videos!
TempusSans 1 year ago
Yes, the document names at 4:22 are a nice touch. A proof for P=NP? I would be interested in reading that...
hammop1 1 year ago
lol at 4:22
jidaanime 1 year ago
Truecrypt is vunerable, she said *probably* vunerable. When you enter the password on it is stored in the RAM memory. After the header is unencrypted the real encryption keys are read to the RAM memory like the password so data can be unencrypted. While the file/hd is mounted you can apply this type of attack. But once you unmount it truecrypt wipe the memory for those informations and this attack is *probably* not valid.
artheseus 1 year ago
That is true, however when the computer is abruptly shut down, (by removing the battery, as mentioned in the video) then the program is not able to wipe the memory.
I read this from their website.
alternate241 1 year ago
I don't think that's true for TrueCrypt
I Won't believe it until you show me on one of your videos.
surechoice 1 year ago
so cool!
Kennedy Assassination though? fair enough...
xpxzampop 2 years ago
@Evi1M4chine Did you even watch this video? It doesn't matter if computer does or does NOT boot from an external disc, since you can cool the RAM module and plug it to another system, and dump its contents from there. -.-
dkaragasidis 2 years ago 3
This comment has received too many negative votes show
hackers are gay
legion2 2 years ago
This can be protected by setting on-boot passwords, bios passwords, boot menu passwords and for the RAM: max out the RAM and epoxy the RAM in place.
Doppelgangergang 2 years ago
I liked the file named "Kennedy Assassination". If only it were that easy. ;)
TLucretiusCarus 2 years ago
Also, TrueCrypt already fixed that problem, by never storing the key freely in RAM, a looong time ago.
Evi1M4chine 2 years ago 25
@Evi1M4chine
Any documentation on this? I haven't seen anything on the Truecrypt website about this.
slickon 2 years ago
@Evi1M4chine
Can you please link to a source which verifies that statement.
feedmepaper 1 year ago
@Evi1M4chine without knowing TC specifically I'd still say it has to store the key in RAM in some form because it needs it all the time for en-/decrypting data as it is being written to/read from the physical disk. It may just not store the key in a continuous RAM region, which would make reading it a bit more difficult, but not impossible if this bitunlocker thing has specific knowledge about how TC stores the key.
hyperthreaded 1 year ago
@Evi1M4chine
What do you mean by freely?
andrewyaoauatauabaea 9 months ago
@Evi1M4chine test
Schwirrsi 5 months ago
@Evi1M4chine Can you or anyone of your supporters prove that statement? Fixed? No. At least their documentation still says today: “Inherently, unencrypted master keys have to be stored in RAM too..”
This will not be subject to change – it is simply not possible without using a TPM.
Schwirrsi 5 months ago
@Schwirrsi
Even if is not, is stupid, prove you can dump an encryption key with a residual image of the joconde.
If any letter or symbol or number is missing on the data file of encryption key it isnt work, all the blanc data need to be brute-forced. If you have more than 20 blank in the key code the probleme is the same has a long password, you need a supercomputer and some years to break it.
Mystermask5047 4 months ago
@Evi1M4chine Nope, see truecrypt docs
"Inherently, unencrypted master keys have to be stored in RAM too. "
freeforthought 4 months ago
NO you retards! The computer does NOT boot from the external hard disk. Except if you were just as retarded, by actually configuring that (or leaving it configured that way, which is the same.) in the BIOS.
And you know this EXACTLY. So youre deliberately lying, to make a point that does not exist for those who really care for their security. (As opposed to those who just leave encryption on by default, because they dont care enough to change anything at all.)
Evi1M4chine 2 years ago
still they can remove the ram and place it on a computer of their own, so...
unknowns5 2 years ago 2
go in bios yourself and change the mode yourself?
iknowbetter 2 years ago
@Evi1machine:
It is possible to create a program on a DVD, insert it, and boot from that DVD. If you want to save your computer in case of a crash, you *MUST* be able to boot from a DVD before your harddisk drive.
So, you can configure the program on the DVD (just like the Norton Ghost wizard) to boot up, and copy/crack/whatever.
This is of course only needed if the eks. HDD boot option is bellow the primary harddisk.
Hildoz2 2 years ago
evetrone can chanege the BIOS settings, you can easily find master-passwords on the internet, so BIOS-passowrds also don't amke the compute secure.
rfvtgbzhn 1 year ago
Authorities in charge of security (U.S. Military Intelligence) assert that all data in commercial RAM instantly disappears as soon as power is cut off. For example, when RAM is unplugged from computer, as demonstrated in this video. This video exposes that myth and shows most security regs and SOPs as most inadequate.
WizardOfQ 2 years ago
dude...thats not how a commercial ram works...not that i want to defend this video, but what is mentionned with the picture in the video is actually right. Its because of the way the ram is made (the comparators and the flip-flops composing the ram are loosing their power gradually, so afterimages of what was there stays for a short time).
next time, try to know a liitle bit more on the subject before saying that something is ''inadequate''
iknowbetter 2 years ago 3
Of course it runs GNU Linux! What else?
felipealvarez1982 2 years ago
haha!!! LINUX UBUNTU RULEZ!!!
Gottgum 2 years ago
i love how this corporate dumbnubs playing black hats with cold boot attack and trying pushing their marketing bullshit
little they know most of pc's that have ECC ram or quick boot enabled in bios will completely make such attack useless
d3f4c3d 2 years ago
her voice is highly annoying -
d3f4c3d 2 years ago
Well duh! This is nothing new.
What kind of "expert" would think volatile memory is magically wiped as soon as power is lost? Other than an "expert" in the Microsoft-bubble sense of the word..
Nobody in the real world of computing would trust that SDRAM module content is gone until it had been explicitly overwritten.. several times (multiple passes for those paranoid enough to think some quantum physics forensic techniques could detect previous states).
Oh no! Think of swapping/paging to disk
CrypticalK 2 years ago 2
I think this can be prevented by turning of autorun on external devices, like that external USB HDD, and by removing anything but the internal HDD from boot order + protect that with bios password(though with removing motherboard battery, that pass can easily be erased)
Truecrypt also mentions this attack in its documentation and says with cooled ram, memory can stay intact for several hours, but with some new types of memory modules it is only 2.5 seconds.
Eruantien8 2 years ago
Remove the battery from your motherboard and you should be safe, right?
lithdim 2 years ago
wrooong
this relies on the fading of ram cells, which aren't powered by the cmos battery... lrn2cptr
the cmos battery is just that. it keeps the clock running and not much else, it doesn't power the ram at any time
the whole point is even when you remove the power, the ram takes time for its stored charge to dissipate low enough to be unreadable
jwalker1196 2 years ago
Just as I posted my comment I thought to myself, "what?".
I know that the battery only holds settings and such for the mobo.
lithdim 2 years ago
hah! "Kennedy Assasination.doc, PxNP Proof.tex, Social Security Numbers.xls"
milkmiruku 2 years ago
So is there anyway to write a shutdown program that wipes the ram on state change?
I don't know how to do it in python maybe I'll try with C.
ItsConcept3D 2 years ago
I think my Acer Aspire One [AOA150] is Well protected, if the data don´t dissapear on all the fucking time it need to get to the Ram Slot, then maybe the key is stored on the 512 Soldered Ram that come in the Motherboard.
Mopetou 2 years ago
3:17 The computer is locked so we normally can't access without user's password
Ophcrack FTW lol
Kabal0114 2 years ago
This has been flagged as spam show
طريقة استخباراتيه جميله
لكن دائما يوجد الاذكى
love saddam for ever
صــ* الله * أكبر *ــدامي للمـــــــــــوت
liononline84 2 years ago
COOL !!
Alucard106 2 years ago
Nice stuff. I see Mac coming with another commercial attacking PC. You guys need to come out with similar stuff attacking MAC users.
cykevinwu 2 years ago
they said that it works on macs too... this isnt an attack its a public service announcement that isnt targeting users of any individual system.
jmpdmnky 2 years ago 3
wouldnt spraying the duster short some of the motheroard of the comp??
totalembarrasment 2 years ago
Not when it is off.
Shmithers 2 years ago
meh, forgot about turning it off, lol
totalembarrasment 2 years ago
Where can you get this ram2usb software?
PILMAN 2 years ago
Good work, guys. Very interesting stuff.
fezir 2 years ago
A "hax0r" that uses Ubuntu? I THINK NOT!
Newberer 3 years ago 3
NOBODY CAN HACK MY BOX! I store all my sensitive data on a stand alone usb drive that has 128 bit AES hardware encryption on it and cycles keys whenever I backup, which means not only does this thing have government grade encryption but it also stores all the keys on the drive itself which has no RAM and you cannot access the drive without the 30 character alpha-numberic password that I change every 15 days...
Ensureqwerty 3 years ago
Easy, I would just use a key logger.
BioSlayer 3 years ago
"stand alone usb drive"
How exactly is a key logger going to help you hack into something off the net?
Ensureqwerty 3 years ago
Not only will a keylogger not do you any good because the box is not online, I use a hardware firewall, software firewall, as well as an encrypted net connection... Even my logitech keyboard has it's own encryption designed to prevent keystroke detection attacks.. bottom line > UNHACKABLE!
Ensureqwerty 3 years ago
None of that would effect a software key logger. If I have physical access, your machine is pretty much compromised.
BioSlayer 3 years ago 2
My encrypted keyboard alone would stop the keylogger. And you would have to find out where I lived to get physical access, considering you do not have my ip, that is impossible for YOU to accomplish.
Ensureqwerty 3 years ago
It would not effect a SOFTWARE key logger.
BioSlayer 3 years ago
Software loggers are very simple in design in order to remain undetected. An encrypted usb keyboard would not be susceptible to these loggers which usually monitor bus or irq, You would need a more advanced logger that monitors USB communication and can crack the encryption scheme. I'm not saying it's impossible, im just saying the simple loggers out there cannot do it. And using a more advanced logger would mean going further up the operating system and make you more vulnerable to detection.
Ensureqwerty 3 years ago
At the end of the day though, this isn't going to stop any keylogger polling the WinAPI for key events.
Every application does this and you can't really distinguish malicious and non-malicious lookups of this table due to the fact most if not all applications poll a vast array of key events.
And like BioSlayer said: Physical Access == Comprimised
sicanjal 2 years ago
I agree and I have stated before that my box is vulnerable to physical attacks, the chances of a physical break in combined with an individual who is able to bypass my security is very remote considering the vast majority of people who commit such breaking and entering don't have the knowledge nor the education to perform such tasks.
Unless of course one of you find out where I live =)
Ensureqwerty 2 years ago
ya cold boot is serious business i got a freezer for all y'all pc's niggers.
killyourselfBRAFFER 3 years ago
PAPER OF THE YEAR
fuckingletmesignup 3 years ago
Really amazing!
nyr7 3 years ago
to boot from an external device you have to get into the bios boot menu right? so if you have your bios password protected this wouldn't work.
ericinsurgent 3 years ago
just press enter when startup and chose which you want to boot from, even if you set password in bios you can clear it by the ClearCMos buttn at the motherboard
novablaze 3 years ago
ya, or as they demonstrated in the video; if all else fails you can just pop out their ram chip and put it in your own machine.
blackcastlesoft 2 years ago
Technically Yes, but if they have access to your computer they could easily flash the bios, by moving jumpers around and wipe all existing passwords on your motherboard.
Kevinedge 3 years ago
WRONG. RAM losses data as soon as there isn't any power. Only capacitors can store power. So the only risk to ur PC when it off. Surges.
slaterking1000 3 years ago
ram acts like a paper where the cpu temperaly write its calculation xP
novablaze 3 years ago
I no. But RAM wipes out wen no power.
slaterking1000 3 years ago
No, look up how a transistor works. Also, the CPU has a cache, specifically for that. The memory is a little different. I think I head an analogy before about it. The space right in fron of you on your desk is the cache, and the drawers to your side are the memory.
Phygar1 2 years ago
no, your an idiot.
ralfyrules 3 years ago
no am right. It will hold a charge for a few seconds, but the data becomes unreadable.
slaterking1000 3 years ago
OMG WHO CAREs!~!~!~!
first off there are better ways to get full access, some taking about 5minz. And for all of you who keep data like this on your lappys i hope this happens to you for being stupid enuff to keep data like that on there.
carnagerpm 3 years ago
haha :P im protected, since i set my keys to be uset in hdd (i set 300mb of it to be used as ram) and i locked the boot process from only my hdd, no other external devices (usb, cd/dvd, floppy,fire wire, etc.)will be run while booting, so there is no possible way on hacking my pc :P
viciokas1993 3 years ago
here it is other Script Kiddie. kid go to school a let this shit to pros.
Socket00x 3 years ago 3
thanks for posting
velvethandofdarkness 3 years ago 2
Good lord. I heard about this from my boss..
FlashStar2491 3 years ago
So when the police burst into my house i should turn off my pc so the ram can erase itself and my Encryption Keys will be gone?
TheGoblinHunter 3 years ago
No, just remove your RAM and break it. Or take a lighter to it (heating the RAM will have the opposite effect of cooling it, and of course melting = breaking :)
devikkyrn 3 years ago 3
i have a better idea! i will place some small amounts of c4 around my ram and when the cops come i push button lol.
TheGoblinHunter 3 years ago 18
(i want to join in the fun)
i have a good idea to, keep a bottle of water and or soft drink next to your computer, and poor it over it...
LandyGerhardt 3 years ago
Cops? I was actually thinking that this is the sort of thing that would be used against authority, actually.
Hateblade 3 years ago
Wow, this is a major vulnerabilty. So like any pro hacker can get make a dump of the RAM while the key is still in it, then extract it? Genius.
AES256bit 3 years ago 2
just turn off your pc/laptop whenever you wont use it or theres people you dont know near, when PC turns off (no energy) RAM DATA gets erased, if you manage to get the data of the RAM after turned off , you are pretty fast..
urbinax 3 years ago
This comment has received too many negative votes show
Lesson learned?
1: Don't use Windows
2: Don't allow your comoputer to be boot from an external USB or CDROM.
mystuff2 3 years ago
Didn't the presentation conclude saying that other encryption technologies on other operating systems were as vulnerable? This attack has nothing to do with Windows specifically.
releeted 3 years ago 12
lesson learned is that ure ignorant to the highest degree
u do realize that mac's also use the same or nearly the same encryption algorithms and methods right? and u do also realize there are memory cards in mac's too? linux may be safer because it is open source but that doesnt guarantee safety either. these techniques can oft be pulled off on any systems if not all the time.
another thing
a common saying for macs: security through obscurity
MODspartan 3 years ago 4
Actually, they're right. You should do your own research, though - "Microsoft COFEE"
Peace.
downhillgames 3 years ago
I have a question. So you turn off the computer with the external hard disk plugged in, and it automatically takes the remaining RAM. But they have like a software in the disk. I want htat software xD
oib4696 3 years ago
Yes, the name of the software is bitUnlocker
pepemark 3 years ago 2
This comment has received too many negative votes show
i blocked it with my special boot modifying software, if it runs from somewhere, the whole external storage device gets scrambled with a worm specially designed by me :P muhuhahaha!
viciokas1993 3 years ago
good job MR.hacker
whant a trophy?
urbinax 3 years ago
Unfortunately, little will block the memory being cooled and then transfered to another computer, as mentioned in the video.
labboc 3 years ago
How about I just drop the 20 lbs magnet on top of my laptop before you put it in your hands, boo supergeeks loose! :)
alpinestarless 3 years ago
Even a very strong magnet will not do a very good job of permanently wiping a drive. And even if it did, the downside to this is that you destroy your hard drive and lose the data in the process.
You lost the benefit of encryption - that you are still able to access the data but someone else can't, even if they have physical access to whatever it resides on.
robgeist 3 years ago
ghsorb lvr
d:P
boydism08 3 years ago
Interesting. I wonder how the ATA disk security ("hard disk password") would come into play here.
Whenever my computer is turned on or wakes from sleep, I have it set in such a way that a password is needed to access the disk. This is hardware (written to the disk itself), and not stored in RAM. Once this is entered, the computer presents the normal login screen.
While surely less secure in many ways than encryption, I wonder if it'd be an easy and practical means of countering this attack.
heypete1 3 years ago
If the computer is stolen while the computer is on, it may still be vulnerable, because the hard disk will still have the decrypt key in its memory. Whether you would be able to freeze and remove the hard drive and then 'hot-swap' it into another system to access like nothing happened, I don't know. I imagine it would be possible but difficult.
robgeist 3 years ago
lol "Kennedy Assassination" "Social Security Numbers"
superbob 3 years ago
MCBathtub... you crack me up man, talking like your a computer 'expert'. If you really knew your shit you would know that RAM consists of silicon wafer arrays that, believe it or not, CAN HOLD DATA after power is removed. Granted they need to be extremely cold. Point B, electricity doesn't use itself up, when the ram chip is unplugged from the computer their is no place for the negative electrons to travel, so they sit in the silicon for a small amount of time. Stop embarrassing yourself kthx
xxbill42Oxx 3 years ago 3
I don't know if anyone mentioned this already, but why the switch from the Vista to Ubuntu box during the demo? Is it booting into Ubuntu from the external HDD? (Around 3:50)
anujbhatt 3 years ago
because he wrote(has) a program for recovering data, that runs in Linux.
shineclot 3 years ago
I think that method wont work when truecrypts auto dismount feature is on or ?
So if you close your notebook the volume will be unmounted so theoretically that attack is quite useless then or ?
I would really like to know if it's still storing the key in the ram once auto dismount was taking place.
crx1337 3 years ago
When a Truecrypt volume is dismounted its associated key is wiped from memory using a cryptographically secure method.
rbrtryn 3 years ago
But if it's mounted when you /physically/ steal the computer, or are at the login password prompt (and the disk is mounted as a system disk would be) when you /cut the power/ to use these techniques, the key is still in memory and vulnerable to these attack methods.
emrecio 3 years ago 3
Which is why you should always dismount the encrypted drives when you leave the computer, as I stated previously.
rbrtryn 3 years ago 4
yea im not scared cuz someone has to steal ur computer, none of this stuff isnt done over the net so im not scared
tmskatap 3 years ago
lmao, a 21 year electrical engineer who 'knows'... come on. Maybe if you would TRY what these people are suggesting, you would find that common literature makes assumptions about this technology that are INCORRECT.
xxbill42Oxx 3 years ago
Very interesting concept. Trabant6666, go fuck a tree and learn some computer science before you go trashing peoples work. I guess you don't understand the concept of DUMPING the contents of memory to disk for viewing. Take an A+ class before you decide to make a hateful post kthx.
PS. Learn to spell and use grammar
xxbill42Oxx 3 years ago
this is stupid and impractical, even single bit from the encryption key (with your stupic error correction) "faded" in ram and you're method is fucked up bitches
trabant66666 3 years ago
see the web site: the research paper talks about ways to recover keys even if a sizable number of bits have decayed
jhalderm 3 years ago
u guys r smart
tbone822 3 years ago
Now heres the question.
Can this technique be used to hack the Xbox 360?
crazyufos 3 years ago
Very interesting. But I don't think this is a software problem. And changing the encryption software would not completely solve it. The encryption software must store the key in memory. If you can somehow read the memory while the key is there, you break it.
acerola123 3 years ago
Why Does her voice sound so much lower after 4:25??
valicourt 3 years ago 2
Hackers love it when you think you know you're safe because you know what a capacitor is.
Its simple folks. Don't leave your laptop unattended, especially in public. You are still not safe even with encryption.
One of you brilliant EEs are going to get robbed. You won't feel so smart then.
Goohuman 3 years ago
Even if this attack were viable, the problem is not with the software. Leaving secure drives mounted when you are not physically at the computer is where the fault lies.
Truecrypt has a simple solution for this, just check the "Auto-dismount when entering power saving mode" option. Now when you put the computer to sleep the keys are erased.
rbrtryn 3 years ago
Props for the Shmoocon sticker on the hard drive.
SonicvanaJr 3 years ago
So what this video is basically saying is that your data is safer if you don't use any encryption at all. Furthermore, it's probably not a bad idea to hold a lit match or lighter above your memory chips each time you shut down your computer to make sure the memory fade faster. These are great tips! Thanks for making the video!
thecoolestviewer 3 years ago
No, it tells how i can get my mothers key! :P
And if you leave your Laptop/PC unattended it should be completely powered down...
megalomania345 3 years ago
Great video!!!
mgilad115 3 years ago
Where did you hear that? Capacitors can hold charge for minutes or hours, depending largely on their construction and insulator. Even a relatively simple glass and metal capacitor can hold a charge for several minutes.
corbaman 3 years ago
Wtf are you talking about? You think the capacitors in RAM can hold their charge for minutes? Not only is a second a LONG TIME, it's more like 100ms...at best.
PoisonRemedy321 3 years ago
Ok, so how long will it take someone to invent a boot device that will flush or overwrite all memory?
hireshka 3 years ago
so if you always shut your computer down, and you have the option to put in the security key every time the computer boots up, you're safe. That's what I got out of that video.
alwaysmc2 3 years ago
Ah so computer manufactures should wipe the memory with their bios. Bios hackers can easily add this feature. What about when the bios does a memory check is it not writing zeros and ones at this time?
jeffsadowski 3 years ago
ya. proly the best solution is a self destruct mechanism which will explode the drive if a second key is not entered within 15 seconds of auth. I'm just waiting for MS to add this to the next service pak. short of that... don't store your porn on hard disk, store it on youtube.
3rdandnowhere 3 years ago
This comment has received too many negative votes show
I could have told you this bullshit easy. If you have physical access to a computer you can do anything you want. Duh.
xlneoMAXlx 3 years ago
What about Checkpoint's Pointsec?
kintaman2 3 years ago 2
i just make sure no one steals my laptop
sgtfusion 3 years ago 5
What about gluing the ram into the notebook / onto the mainboard so that it can't be removed without destroying everything? Boot from external media (others than the internal hdd) can be disabled, too.
Then, something like that won't be possible that easily ;)
tekknobanane 3 years ago
This is assuming a) The laptop is set to boot via USB(which is VERY rare), b) The laptop has slow-clearing memory, c) The attacker has physical access to the laptop straight after someone has shut it down. d) The victim won't be surprised to see that his perfectly fine laptop has lost its power somehow and reset and has white frothy crap all over it. e) The attacker will be able to access the laptop a second time.
It's absolutely impractical. Use a keylogger, social engineering etc instead.
wefinishthis 3 years ago
if you read the page, they found that even at room temp they can still use the memory with just a can of air.
Pentium965 3 years ago
yea you are right.....there are too many variables for this to be a practical method of hacking. What is social engineering btw?
jamal22066 3 years ago
True but non the less interesting.
jeffsadowski 3 years ago
social engineering is a hacking method that tries to guess passwords based on your personality. they would observe you, try to get information of your life, such as names and birthdates of wife/hubbie, kids, pets, etc., and use those and variants of them as guessed passwords.
viv3210 3 years ago
But it is one of many(?) possible solutions to get the data you stored.
bon3fire 3 years ago
This has been flagged as spam show
boooorrrrriiiiiiiiinnnnnnng....BORING
ShutUpDouchebag 3 years ago
Even without DRAM recovery, most disk encryption packages are subject to password breaking dictionary attacks as long as you have physical access to the device. Most users passwords contain 18 bits or so of entropy, so rather trival to dictionary attack.
corbaman 3 years ago
There is a VERY simple way to prevent this from being and issue on many systems. Set a BIOS password that is required both to boot the machine and to change settings like the boot order. Then simply make sure the machine is not set to boot from a USB drive. As for pulling out the RAM, that can't be completely prevented but some epoxy holding the RAM in should make sure it can't be taken out intact while it still contains data.
hackerx31337 3 years ago 2
interesting
GordonFr33man 3 years ago
digg
kakkaface 3 years ago
An application that simply zeroed all ram during shutdown and erased any password fields on disk would solve it. People wouldn't be able to use sleep mode, suspend or leave it long enough for the password screen to be sitting there, but it could be worth it. Also don't turn your back on your computer, lol.
flyp1001 3 years ago
This comment has received too many negative votes show
You people are terrorist. Stealing laptops and personal information, and even making videos to show other people how to do it. I hope you die in your sleep
ligyro 3 years ago
Princeton people are not terrorists retard
AngelPancia 3 years ago 2
This comment has received too many negative votes show
You guys feel happy about yourselves for stealing laptops and personal information? fags. 1/5
ligyro 3 years ago
thank you for sharing this ! scary stuff !
SoundGuyDavo 3 years ago
wow this sucks XD
stfukent 3 years ago
we can even get freeze burn by touching the ice cold object with bare hands, brilliant
SoundGuyDavo 3 years ago
so essentially, never leave your laptop out in the open at a public area
MajorBiscuits 3 years ago
Huh. Thought this was common sense.
But really, there is almost no risk of a theif being smart enough to do this. They will just wipe your disk and sell your laptop.
personmans 3 years ago 2
No. The point is power down your lap top when you are done, rather than using sleep mode, IF you are are depending on encryption to protect the contents of your files from prying eyes.
beffer2000 3 years ago
If anyone is still worried here is a few tips and suggestions:
The software is made by this organization, not an everyday criminal.
If your paranoid over your information getting stolen go check out Absolute software, They'll install a chip in your laptop that will remotely destroy the hard drives information and can recover the laptop through GPS. So even if they crack the encryption on the hard drive there will be nothing on it.
kowardingkyle 3 years ago