Researchers Find Way to Steal Encrypted Data

NY Times ^ | February 22, 2008 | JOHN MARKOFF

[neverdem]

SAN FRANCISCO — A group led by a Princeton University computer security researcher has developed a simple method to steal encrypted information stored on computer hard disks.

The technique, which could undermine security software protecting critical data on computers, is as easy as chilling a computer memory chip with a blast of frigid air from a can of dust remover. Encryption software is widely used by companies and government agencies, notably in portable computers that are especially susceptible to theft.

The development, which was described on the group’s Web site Thursday, could also have implications for the protection of encrypted personal data from prosecutors.

The move, which cannot be carried out remotely, exploits a little-known vulnerability of the dynamic random access, or DRAM, chip. Those chips temporarily hold data, including the keys to modern data-scrambling algorithms. When the computer’s electrical power is shut off, the data, including the keys, is supposed to disappear.

In a technical paper that was published Thursday on the Web site of Princeton’s Center for Information Technology Policy, the group demonstrated that standard memory chips actually retain their data for seconds or even minutes after power...

--snip--

The issue of protecting information with disk encryption technology became prominent recently in a criminal case involving a Canadian citizen who late in 2006 was stopped by United States customs agents who said they had found child pornography on his computer.

When the agents tried to examine the machine later, they discovered that the data was protected by encryption. The suspect has refused to divulge his password. A federal agent testified in court that the only way to determine the password otherwise would be with a password guessing program, which could take years.

A federal magistrate ruled recently that forcing the suspect to disclose the password would be unconstitutional.

[neverdem]

I don't care about creeps. I do care about security, and I do care about the U.S. Constitution. I took an oath.

[The Spirit Of Allegiance]

Google to Store Patients’ Health Records, Raising Concerns
http://www.freerepublic.com/focus/f-news/1973826/posts

[neverdem]

New Stroke Therapies Show Promise

Russia: Super-light aviation for Vladimir Putin. Video

IBM experimenting with DNA to build chips

FReepmail me if you want on or off my health and science ping list.

[ThePythonicCow]

The first half of this post, concerning cracking encrypted disks, is popular. See also related FR posts at

• Attack on computer memory reveals vulnerability of widely-used security systems,
• New Research Result: Cold Boot Attacks on Disk Encryption (keys vulnerable in DRAM after power cut), and
• Disk encryption easily cracked, researchers find.

[SunkenCiv]

thanks neverdem.

Disk encryption easily cracked, researchers find
Network World | 21 February 2008 | Network World Staff
Posted on 02/22/2008 11:20:54 AM EST by ShadowAce
http://www.freerepublic.com/focus/f-chat/1974545/posts