Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 42 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Hardwarearrow Killer Hack
EH-Net
May 23, 2013, 10:37:12 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Killer Hack  (Read 12679 times)
0 Members and 1 Guest are viewing this topic.
iSmith
Full Member
***
Offline Offline

Posts: 157


Do or do not. There is no try. - Yoda


View Profile
« on: February 26, 2008, 08:32:00 AM »

Some hardware hackers have just found a way to hack encryption standards. RAM data lasts for a few minutes after shutdown, so the hackers exploited that. read the full story here http://www.techradar.com/news/computing/why-disk-encryption-may-not-be-enough-247012
It's interesting. Smiley
Logged

In my eyes, your operating system is as solid as swiss cheese.
Bogwitch
Jr. Member
**
Offline Offline

Posts: 51

Senno Ekto Gamat


View Profile
« Reply #1 on: February 26, 2008, 09:12:50 AM »

iSmith,

The problems of RAM retention are nothing new - this has been known of for a while. Only recently has proof-of-concept been made public.

It is very dependant on at attacker gaining physical access to a machine soon after shutdown and either being able to freeze the memory or transfer it to a test machine pretty quickly. It would be unlikely an attacker would want to use the original host machine for the memory recovery as some BIOSes clear the memory at system startup and booting an OS, however small, would overwrite some memory.
So, if you're worried about this, ensure you have a second boot partition/floppy/cd/usb that has a memory purge application or sit and wait a couple of hours for the RAM to dissapate fully.

Related, has anyone thought about modding a DIMM holder to provide a voltage and refresh clock in order to transport the memory and have it retain it's content indefinitley? Who needs liquid nitrogen? Maybe this should be in the forensic thread...
Logged

CISSP, C|EH, C|HFI
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #2 on: February 26, 2008, 09:58:52 AM »

They were able to use this technique to crack Nintendo's encryption for the Wii. See the topic about it it started by don.
Logged

Mike Conway
CISSP
CompTia Security +
C|EH
JobMatchNow
Newbie
*
Offline Offline

Posts: 24


View Profile
« Reply #3 on: June 12, 2008, 09:46:45 AM »

I always thought computers were not safe.
Logged
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 233


Klaatu, Borada,Necktie?


View Profile
« Reply #4 on: June 12, 2008, 09:59:40 AM »

I always thought computers were not safe.

They're not...they're evil, vile machines.  As your attorney, I advise you to never use one again.
Logged

Reluctant CISSP, Certified ASS
eth3real
Sr. Member
****
Offline Offline

Posts: 309



View Profile WWW
« Reply #5 on: June 12, 2008, 04:34:00 PM »

They're not...they're evil, vile machines.  As your attorney, I advise you to never use one again.

Not even to check the EH Net forums? Tongue
Logged

Put that in your pipe and grep it!
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 394



View Profile
« Reply #6 on: June 13, 2008, 03:39:20 PM »

An old professor of mine told me... "If you want a secure computer, make sure it's not plugged into ethernet.... and fill the room with cement."  That's about the only way to get a 100% secure computer, that's not broken.  Tongue  Computers are fun though, must... have... computers.
Logged

"Bad.. Good?  I'm the guy with the gun"
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #7 on: June 15, 2008, 03:32:33 PM »

An old professor of mine told me... "If you want a secure computer, make sure it's not plugged into ethernet.... and fill the room with cement." 

I can't vouch for the authenticity as I'm too young (thank god) but apparently that's how M$ got NT4 through it's security standards: removed network cables, floppy drives, any IO device (keyboard/mouse/etc.) and locked the door. 100% secure...
Logged

eth3real
Sr. Member
****
Offline Offline

Posts: 309



View Profile WWW
« Reply #8 on: June 16, 2008, 08:40:58 AM »

apparently that's how M$ got NT4 through it's security standards

That is a really scary thought.
Had to remove everything but the processor to make it secure.
Logged

Put that in your pipe and grep it!
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 394



View Profile
« Reply #9 on: June 16, 2008, 03:16:26 PM »

Heh... most people don't realize that physical access to a machine... makes it inherently insecure.  If it can be booted... it can be booted onto something it wasn't ment to be, with enough playing around.  That's when I found a public kiosk in one of the buildings had it's USB slots accessable, AND the power on/off button accessable.. I was rather pissed.  Then I realized it didn't go into my LAN, but the LAN of another department... then I wasn't quite so pissed.  But I did make mention of it. Tongue
Logged

"Bad.. Good?  I'm the guy with the gun"
jason
Hero Member
*****
Offline Offline

Posts: 1012



View Profile WWW
« Reply #10 on: June 22, 2008, 08:39:33 AM »

It would be unlikely an attacker would want to use the original host machine for the memory recovery as some BIOSes clear the memory at system startup and booting an OS, however small, would overwrite some memory.

Yes this is a danger, but you would need to either know what type of ram was in the machine in advance or have several machines handy to transfer the ram to. I would think that this would also increase the possibility of heating the ram up enough to lose the contents in the process.

So, if you're worried about this, ensure you have a second boot partition/floppy/cd/usb that has a memory purge application or sit and wait a couple of hours for the RAM to dissapate fully.

You would need to do this every time you left the machine, which sounds like a bit much. Physically restricting access to the ram might help.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.111 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.