Friday, February 22, 2008

RAM holds data even after power is off, helps to break disk encryption

A group of Princeton researchers discovered a clever way to break virtually any disk encryption with help of an... air duster and a screwdriver! Secret lies in the little know fact that computer RAM memory doesn't actually loose all of it's data instantly after a power off! I was amazed to find out that some RAM chips will hold it's contents for seconds or even minutes after they stop receiving any power. And data doesn't fade all at once, but gradually. What's even more is that if you cool RAM chip down it can keep it's contents intact much much longer. And this can be achieved by a household air duster.
Now I'm getting to the breaking encryption part. Thing is that decryption key is stored in the RAM. So by dumping and analyzing RAM's contents one can find this key and decrypt contents of the hard drive. This method is not 100% effective, as it assumes that user already entered password before memory contents were wiped out.
Check out the video!

No comments: