View by:

The Cold Boot Attack

Tuesday, July 7th, 2009 – running time 26:09
When it comes to recovering encryption keys from memory nobody has a more intriguing method than Princeton University researchers. We explore a method known as the "Cold Boot Attack". Plus, a clever DirectX injecting UI widget for your PC games that means the end of ALT+Tab.

When it comes to recovering encryption keys from memory nobody has a more intriguing method than Princeton University researchers who pioneered what is known as the Cold Boot Attack.

Their paper, Lest We Remember: Cold Boot Attacks on Encryption Keys debunks the popular assumption that RAM modules lose their contents when power is lost. As it turns out the degredation of memory can be a matter of seconds to minutes at room temperature. Furthermore this degredation can be slowed by freezing the memory module.

The researchers go on to outline several methods for copying memory from a reset computer or extracted RAM module. Princeton University's Center for Information Technology Policy site maintains the paper, videos, and source code from the research.

The USB / PXE Imaging tool in combination with the AES Key Finding tool are a powerful combination. In this week's show we discuss and demo these tools in action.

We also touch on the McGrew Security RAM Dumper and Foremost.

After laying the ground work for this attack I'll be back in studio next week with more in depth demos and answers to your questions. Please send your feedback and questions along to feedback@hak5.org.

--Darren Kitchen

PlayXPert is a unique in-game overlay for PC and MMO games, incorporating the popular use of social media and the web with the importance of impressive FPS and un-distubed gameplay. PlayXPert lets you play your game without ever having to Alt-Tab out of the game by downloading the small widgets and customizing your opacity, widget settings, and key bindings. You can see it for yourself at their site: PlayXPert.

--Shannon Morse

Also don't forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Highlights
squarespace ( 0:32, 2:11, 2:39, 25:35, 0:32, 2:11, 2:39, 25:35 ) operating system ( 5:42, 5:42 ) video game ( 19:18, 19:18 ) high school ( 24:37, 24:37 ) squarespace ( 0:32, 2:11, 2:39, 25:35, 0:32, 2:11, 2:39, 25:35 ) operating system ( 5:42, 5:42 ) video game ( 19:18, 19:18 ) high school ( 24:37, 24:37 )

Automatically Generated Transcript(may not be 100% accurate) ( more )

" War."

" Coming up on this episode of Hak5 recovering encryption keys from memory using the called big attack. And never alt tab out of the game ever again using play expert. All that and more on this episode of Hak5. That's the I I was brought to you by godaddy. Squarespace. Game flag and viewers like you."

" And we -- we can do. I go onto the --"

" so what you have. Kleenex -- It's a nifty little program that overlay is on top."

" Your videogames on your PC and you can -- eventually agency can do Twitter friends right yet here's -- you know -- leopard that's the thing. -- says Larry -- Over USB key now because it didn't. You know coming back from TrueCrypt it last week yet who extracting -- yes he's memory. It."

" Parade."

" Account obviously. Just when you equipment. And one very. Always."

" It's July 4 weekend. There's going to be a lot of people -- like. That."

" With Squarespace you can build beautiful looking blogs -- web sites in a fraction of the time it would take -- traditional content management system there intuitive drag and drop interface is as snappy as powerful as a desktop publishing app. But best of all there's no software to install new database to configure their patches are applied and no code to -- it. -- yourself a simple and powerful it can be with a two week free trial that's -- space dot com and use promo code hack. Five to support the show and save 10% off the life of your service Squarespace dot com."

" So we've been talking about so many encryption things even easier and computer. You you can protect yourself from -- by encrypting it with TrueCrypt. And now I am saying that there's a way around that you don't exactly have to do. Right and -- really protect yourself completely."

" It is and that's something that at that time and again is that when it comes to you physical access to some these computers all bets are off. Now that's yeah. And I kind of -- lake -- you know it just and then noticeable we talked about last week that TrueCrypt had to be asked to talk about. The research that the matter Princeton University last year when it comes through. Yeah it comes to retrieving. Encryption keys. So it's an -- teammates in video on YouTube lots of guys that some breast care Stephen -- yeah -- freezing -- thank -- Well the good thing. Of that is that zone you know. Contrary to popular belief when a that may just become -- graduate Gateway and it's gonna change depending on manufacturing lots of different very. The point game in momentary loss of power -- really do believe that isn't going to completely clear everything out of memory. And we know from the encryption is that when you type your password. That key whether he added a yes or whatever is distorted memories that. Keep that going up and that's where. The vulnerability lies and the -- researchers system that through the level of you know okay cool programs got this good steps in the memory. Through trying to you know break into computers than any different other ways. You know the keys in -- still the -- That's scary heck. So there's a couple of different versions of this attack. And basically there's. -- that runs a couple different ways. That basically dumps everything in the computer's memory to drive C and later this data -- And there's a version that. Lives on my bitter little device in the world a little USB stick. And this is something that's simulate. I just yeah let's say for instance we were here. The copy shop and you decided you needed them. Milk cream whatever right right and then leave and you leave your laptop just was -- herewith a look at what's I would never frankly you leave it unattended for a moment. To go get some things servers something. In the United States keep going get whichever I could come up your -- this -- Hold down the power button until such time. Right back on and it would do all this is seeking an antenna to bias configured -- point being at the office and what's on this USB key. Is eight and nine and -- plate program so there revered here as well -- wow. It's not even an operating system running -- it -- it's really cool. So. What this does is it -- all of the memory on your computer to this drive. And and and I can later you take that drive out and and do some analysis when you come back your computer and it's just been revisited."

" Now when you plug this into your computing started to get the data from my computer. Are you gonna lose any thing since it's think about how often it's slow illegals a lot of."

" Bully and then there's there's some good points there first off is that I guess you're going to lose. That he. Depending on the manufacturer in the -- different variables the can be sent degradation of the memory. And more importantly. The program as I mentioned is about nine until the -- or somewhere when you did all this it's going to story -- it's going to over write some sector. Step right at any a little bit you computers got a gigabyte of ram I'm going to keep really well -- That's what hopefully I don't know right EST. Encryption that's that I'm looking for. Yeah but otherwise. It's really cool here's. More than just leave it be that the it's an interesting there's a there's way to do this with -- he did which is. Booting off network card. And then you need HTTP server and -- the ftp server on somewhere on the network to provide you with the program but rather than using USB -- See your recent computer the network card is good -- Another machine. And then thirdly there's. Really interest and in that case it doesn't right it's like yeah. Have a drive connected to actually -- memory out over the network and just that. I was -- yeah it. But the more difficult set up I like -- speakers but good news if you really want to get sophisticated. Here's a version of this where you can put it together with what's called wear boots which is basically like Linux on your bios I think it was actually a -- excellent point. But basically you take it does specialist motherboard lot of policies -- can do this and put this program on here and you can put that -- let her like I said. On the biased right so you can steal the memory physically take the ran out of the computer and into your specially crafted motherboard. You don't need to override any of the memory wow you don't faulty it's -- whatever. So it that would be Atlanta actually take memory out and they freeze it right at act. Or he could just -- because you know. You get it powers likely Apple battery out of left about him. And he wanted to get it cold lake. And and that's one of the key things. Yes slowing down the memory degradation only seconds even a few minutes in some instances the husband next. I don't it it. There and then there are few different other variations of this other than just the that's the -- researchers. Which they have really available it's easy to get. Start with that but the through security -- jumpers another version and I'm sure there are many others. That do similar things affect you later on we'll talk about doing this while computers still running. Who. And then I guess he was as -- of the technical that's our interview the only the real thing important mention here is that. So I'm using it or gigabyte USB key. For this this is this particular version -- 32 bit which would also work on 64 bit. But there's special 64 bit version out which would allow me to address more the memory. So like this wouldn't work so well on my computer and because it's in the ram yeah yes you need a bigger -- there's even ways. He lives to specially crafted a iPod. He did so as something really conspicuous looking as an iPod now -- could be device for you know -- missing data. Unsuspecting beauties."

" Wow at a critical and -- it might -- I think that so."

" You're booted up here on your laptop and let's just pretend you go and and -- get tough -- today and a -- demonstration -- Noble but first we can do it."

" And now."

" Keep your personal information away from spammers hackers in your crazy ex roommate private domain registration from godaddy.com protects your privacy. But keeping your address phone number and more out of the public database. Check out revision3.com. Slash godaddy for all of our godaddy codes in offers."

" So I'd been in into my laptop I put in my encryption password -- my -- usual when it happens weren't I'm logged in you know everything's. Just fine everything's encrypted it -- nobody can feel my face. I -- to get my -- I come back. What happened."

" But if so what I have to US Packard is taken up. And it's running and I'm just gonna go ahead -- time in the USB key here. And then. I am going to do it pop the battery back -- very quickly. Probably quicker than that and and present power button and then on your computer. Let's do is press F twelve. But times this -- and use the there you go. It starts dumping memory wow. So I understand that let it do its thing there but yeah okay so. It takes a few minutes right so if you're just got I think she I -- that's the last round right -- my. I mean it and different schools take the amount of time different ones are more sophisticated than others I'd like USB one just because of rights to its own memory. Or you know you don't have to set the network that he -- The idea that especially specially crafted motherboard they carry around like that. You know. Sent this a few minutes this USB keys. How do you build it how to make this thing. But if so the who. The person that I'm running and and I think with the big through security. Random result but the reason I'm using is one really a Princeton. -- tech researchers and it's. Now the code is really easy download all your view is pilots there's a note that. It weighs. That you need if you're compiling with GCC four point one relating yet to use. A new stack protector -- let's. All all have. You know information about that but it basically. Yeah you have to get files and once you do what happens is. The package -- comes with a little thin flat and -- and file they use DDT. Image onto your flash drive. So that is bootable. And then that's pretty much it that's that's the pool in a nutshell in doing USC style -- now. -- But once -- that we just an adult art argument here we -- 30% and so we are ready data that's taken right. And and that's it now once that's gonna take that unit start. On Monday and I've got a copy of your Mac. Kennedy that he. You'll like it or -- images and things like that basically. I just like you would have to take with you click forensics analysis and stuff and he and that's that's in your memory. I can get so actually cheaper room called foremost. You know -- burns like a magic rescuers and descent text editor to extract data from within memory so I'd like you. For -- because it supports a lot of different file formats it's tags documents stuff like that. And -- whatever was in ram I just you run it against this tool and that makes you know copy of it proud of that memory dump. And then there's this there's and again it over this but the researchers. R&B S and and Horace today. Keep dumping -- keep finding utilities so. -- when you build your -- your TrueCrypt boy you're Apple to speakers and it is yet to -- as well that's this program implying that. Yeah strings and the like hey you know longhorn is it -- the strings and says hey that's what I'm Xbox. And that. Yeah and it makes you wonder really you know -- use. Yes blue fish and then 3-D yes I get -- way to get all. -- there's a good start stacking correction you know hey you think eventful ones are. So I need your crazy having layers. Or and others like puppet strings -- that the program is like Linux you can use the bird strings tight -- and look for something within your disk image though. Companies username was there's something like that. Yeah I could potentially clintons -- nation's streams. Basically. It's data mining hit -- analysis you know use the same chemicals you use recovers from your hard drive or something. She basically told me that. You know my encryption is worthless it now it -- and this -- and it's it's it's a layer of your defense and that bear in mind physical security in mind you know. When somebody has physical access your machine all bets are off those that's -- is justice. Keep my computer close -- What I mean that is a remedy as well as -- looking into some -- and encryption so rather than to say yes music like I said. Yes yes excuse whatever. In combination. There's also. As far as like an -- wanting to talk Fella here right where you you can keep you warm room and -- Excellent show on -- so but. There's something to be said about it like an enterprise buyer would constantly servers. Servers typically ECC memory. I've talked about this recently when we filthy 2000 dollar or white box. That's because -- on the motorcycle now. And and we what -- desktop memory and it just it just reboot the computer -- has gone down or it turns it off but got got to the in the."

" We'll right well now this brings up another question it's free minute not gonna know I come back my computer and revisit."

" Yeah and also that they were running windows well I -- back to the computer who created what could have possibly happened quietly get it -- what I had in my parents with a helpful."

" A full battery act that was perfectly fine when I left it here with -- of course you could be that's that's us and our viewers -- Yeah so what about lake what is happening hibernate. A good point you're right."

" Hibernate and suspended in some cases life -- you keep the ram it -- keep the encryption key in memory. So. I knew that it here 800 vendors and security software. But yes if you were in suspended IQ you know. But -- what they Acer aspire wants that in your Apple laptop hard to. Memory but if I could act quickly and get some compressed air and light you know slowed down up against my specially crafted motherboard with yeah. And share. I don't think that's his rifle and then there's -- saying in the enterprise environment where servers. -- easy CC unity and smaller. White box here. But if we did it's more expensive memory a lot of times what this or is -- servers when they are revisited. They actually scrub the ECC memory or zero out all of the debts so it's that may be some that may be. That's an insulator defense that's the idea that something to consider it and -- really have to get around -- that's why it's nice to be it would take the -- put it on your. Furthermore. If somebody wants to take the memory out of your server put -- in their -- motherboard doctor ram and they like it that'd be a senator. You might want to use alarm. It's. Through a lot of server it's. The ability to settle. Alarms. They get out and if they get opened it would basically tells motherboard and hopefully that. -- We have an entire conversation about the team servers and rotating -- memory and back powering stuff concealing servers. It's I would find something fantasy. To take a mine and and I I find that there's a lot of fun things that can be not not even just. Encryption in certain stuff that -- mind that of the data that's in your memory when you that's really -- man so I -- next week we will."

" Hello pro computer it just so we can freeze the area and taken out -- another computer it's still -- in."

" And then we can take that memory that we don't and included on the form and -- the kids would try out different Hamas isn't. I don't mind have ethernet --"

" And didn't get through get -- here so well of the story don't leave your computer and build on top into the encryption difference science. I think that."

" I want to let everybody knows that. -- on its service. They are the largest online video game rentals service and offer a choice over 6000 new and classic titles across all councils and -- we plants are you 1595. -- game -- members can rent one -- four games at a time and keep them for as long. As life you can also purchase a game if you fall in love with it spills into the box and manual. Pornography. And on over to gain slide dot com slash Hak5 to get. Two week free trial versions -- dot com slash."

" It's. Little does dummies they're just like standing there Atlantic. And London. -- clear Brookner. One brains."

" So is this it's there's our expert. Yes that well do you have a problem where you're playing counterstrike source and you wanna I don't know hit alt tab in going to hire seat. And then you come back to your game and it's completely frozen and -- you very died as somebody got a head shot already. Your dad's saying it's nothing is really old airline. Yeah. No actually."

" And let -- take zero point nine when I first started playing competitively. Plans we section removed when these keys from keyboards. Or -- Happen just because you press that in my game you can sound how badly I have. And then you."

" Well now you don't have to worry about that whether it's -- aim or some other game. I you have to do is download play expert and you get. You get Twitter you get Gmail and get him or he got all sorts of little widgets inside your game which don't screw up your performance too much and you're -- ago you never have to leave your game. So this is just yours even ask these games has easily -- Definitely let's that's what's with anything cable. You said Gmail literally easy widgets are these something that I don't want to. -- There it comes with like six or seven different widgets are ready packed inside of it which you can remove if you want to keep my captain just for this. For the assignment but it also comes with like fifteen other ones that you can download separately and include into play an expert that way. I'm so -- door opened up here a command prompt. My voice control. Friends. Gmail and PC diagnostics so. Has actually like to -- afterwards and he is an awesome that's so yeah since there are boxes and we got back -- Now let's see here's Firefox and Firefox kill the process yes. That it's gone it's. Singer built. You're not worth it for -- yet -- in cool. So you gotta like games like god what's taking up so much memory so you can open up as closed when every need to pack -- steam whenever I eat it well log me in. -- need them running iTunes over. Like if it here until -- Chico saying you can just coming here and as I keep finding it go and play episode -- it's like yes you Logitech he would like all the actually. It was okay. So I play a key binding to each of my little widgets so all I have to do is press line and in. And look at that I can see my PC diagnostics in the eyes again. So we're gonna look -- memory usage yet you can play. With this for awhile. I think it's not -- it easier to use it. Well I was working yes working very very hard I and it will how hard is -- computer. It's working pretty hard I mean obviously I don't have the best computer in the world and it keeps you running right I didn't -- video card yet. Well first foreplay expert in the a couple of things core two duo as -- recommendation. Along with two gigs of ram and and your graphics card means the you know PCI express -- that. For my computer my performance is pretty dead except when I open Twitter in the tunes widgets. Whenever I try to open the Twitter widget. I had -- running in the background I gave I didn't play expert my username and password so I can tell Twitter whenever I start making and name. But if I try to Twitter it through the Twitter client while it in the game and you my 140 characters personal ones. It completely freezes well and -- will objecting. He adds it's -- is that in the -- and doesn't work too well because I why he's iTunes so anytime I open that up. Guys who runs iTunes and I you know Nancy. It -- yes so what that don't I didn't try pandora and indoors for going to -- them like. And it's. Playing my game that's simple put my music in the background CI."

" And Natalie wonders right and know how -- this -- and another monitor. One. Yes -- tires easily and once the athletes would want to go there it types. This is me greatly especially CS where you get killed."

" You've gotta wait around -- everybody else -- Elliot lake street for a minute I or anybody else finishes their match and you get to go back into the game well why awaiting you can browse the web."

" These would -- it's the high school is where you just write JavaScript."

" All -- TC Sharon and Microsoft visual studios so they're a little bit more errant proprietary and he asked. Fern developers you know anybody -- didn't develop their own widgets for this it's not just the play expert people -- If you want to develop a widget where you can you might go ahead redhead it's fully -- back."

" I think there wraps up this episode I thought it."

" And of course you guys have any questions or comments about it this if you've seen on the show this week ahead posts in the -- this up on the comments and blog you know he's backpack -- better or. We love it here -- guys think it will take some of the stuff then did a the lab next week we'll -- after."

" And don't forget we're haven't hack -- on August 15. Gonna Hak5 -- up dot Squarespace dot com to find out all the details at Busch Gardens Williamsburg yes with the Newfoundland."

" But the guys as -- out there so that we can all together. That's the tech."

" Kids."

" Just look at me like. The bathroom you lady."

" War."

" Coming up on this episode of Hak5 recovering encryption keys from memory using the called big attack. And never alt tab out of the game ever again using play expert. All that and more on this episode of Hak5. That's the I I was brought to you by godaddy. Squarespace. Game flag and viewers like you."

" And we -- we can do. I go onto the --"

" so what you have. Kleenex -- It's a nifty little program that overlay is on top."

" Your videogames on your PC and you can -- eventually agency can do Twitter friends right yet here's -- you know -- leopard that's the thing. -- says Larry -- Over USB key now because it didn't. You know coming back from TrueCrypt it last week yet who extracting -- yes he's memory. It."

" Parade."

" Account obviously. Just when you equipment. And one very. Always."

" It's July 4 weekend. There's going to be a lot of people -- like. That."

" With Squarespace you can build beautiful looking blogs -- web sites in a fraction of the time it would take -- traditional content management system there intuitive drag and drop interface is as snappy as powerful as a desktop publishing app. But best of all there's no software to install new database to configure their patches are applied and no code to -- it. -- yourself a simple and powerful it can be with a two week free trial that's -- space dot com and use promo code hack. Five to support the show and save 10% off the life of your service Squarespace dot com."

" So we've been talking about so many encryption things even easier and computer. You you can protect yourself from -- by encrypting it with TrueCrypt. And now I am saying that there's a way around that you don't exactly have to do. Right and -- really protect yourself completely."

" It is and that's something that at that time and again is that when it comes to you physical access to some these computers all bets are off. Now that's yeah. And I kind of -- lake -- you know it just and then noticeable we talked about last week that TrueCrypt had to be asked to talk about. The research that the matter Princeton University last year when it comes through. Yeah it comes to retrieving. Encryption keys. So it's an -- teammates in video on YouTube lots of guys that some breast care Stephen -- yeah -- freezing -- thank -- Well the good thing. Of that is that zone you know. Contrary to popular belief when a that may just become -- graduate Gateway and it's gonna change depending on manufacturing lots of different very. The point game in momentary loss of power -- really do believe that isn't going to completely clear everything out of memory. And we know from the encryption is that when you type your password. That key whether he added a yes or whatever is distorted memories that. Keep that going up and that's where. The vulnerability lies and the -- researchers system that through the level of you know okay cool programs got this good steps in the memory. Through trying to you know break into computers than any different other ways. You know the keys in -- still the -- That's scary heck. So there's a couple of different versions of this attack. And basically there's. -- that runs a couple different ways. That basically dumps everything in the computer's memory to drive C and later this data -- And there's a version that. Lives on my bitter little device in the world a little USB stick. And this is something that's simulate. I just yeah let's say for instance we were here. The copy shop and you decided you needed them. Milk cream whatever right right and then leave and you leave your laptop just was -- herewith a look at what's I would never frankly you leave it unattended for a moment. To go get some things servers something. In the United States keep going get whichever I could come up your -- this -- Hold down the power button until such time. Right back on and it would do all this is seeking an antenna to bias configured -- point being at the office and what's on this USB key. Is eight and nine and -- plate program so there revered here as well -- wow. It's not even an operating system running -- it -- it's really cool. So. What this does is it -- all of the memory on your computer to this drive. And and and I can later you take that drive out and and do some analysis when you come back your computer and it's just been revisited."

" Now when you plug this into your computing started to get the data from my computer. Are you gonna lose any thing since it's think about how often it's slow illegals a lot of."

" Bully and then there's there's some good points there first off is that I guess you're going to lose. That he. Depending on the manufacturer in the -- different variables the can be sent degradation of the memory. And more importantly. The program as I mentioned is about nine until the -- or somewhere when you did all this it's going to story -- it's going to over write some sector. Step right at any a little bit you computers got a gigabyte of ram I'm going to keep really well -- That's what hopefully I don't know right EST. Encryption that's that I'm looking for. Yeah but otherwise. It's really cool here's. More than just leave it be that the it's an interesting there's a there's way to do this with -- he did which is. Booting off network card. And then you need HTTP server and -- the ftp server on somewhere on the network to provide you with the program but rather than using USB -- See your recent computer the network card is good -- Another machine. And then thirdly there's. Really interest and in that case it doesn't right it's like yeah. Have a drive connected to actually -- memory out over the network and just that. I was -- yeah it. But the more difficult set up I like -- speakers but good news if you really want to get sophisticated. Here's a version of this where you can put it together with what's called wear boots which is basically like Linux on your bios I think it was actually a -- excellent point. But basically you take it does specialist motherboard lot of policies -- can do this and put this program on here and you can put that -- let her like I said. On the biased right so you can steal the memory physically take the ran out of the computer and into your specially crafted motherboard. You don't need to override any of the memory wow you don't faulty it's -- whatever. So it that would be Atlanta actually take memory out and they freeze it right at act. Or he could just -- because you know. You get it powers likely Apple battery out of left about him. And he wanted to get it cold lake. And and that's one of the key things. Yes slowing down the memory degradation only seconds even a few minutes in some instances the husband next. I don't it it. There and then there are few different other variations of this other than just the that's the -- researchers. Which they have really available it's easy to get. Start with that but the through security -- jumpers another version and I'm sure there are many others. That do similar things affect you later on we'll talk about doing this while computers still running. Who. And then I guess he was as -- of the technical that's our interview the only the real thing important mention here is that. So I'm using it or gigabyte USB key. For this this is this particular version -- 32 bit which would also work on 64 bit. But there's special 64 bit version out which would allow me to address more the memory. So like this wouldn't work so well on my computer and because it's in the ram yeah yes you need a bigger -- there's even ways. He lives to specially crafted a iPod. He did so as something really conspicuous looking as an iPod now -- could be device for you know -- missing data. Unsuspecting beauties."

" Wow at a critical and -- it might -- I think that so."

" You're booted up here on your laptop and let's just pretend you go and and -- get tough -- today and a -- demonstration -- Noble but first we can do it."

" And now."

" Keep your personal information away from spammers hackers in your crazy ex roommate private domain registration from godaddy.com protects your privacy. But keeping your address phone number and more out of the public database. Check out revision3.com. Slash godaddy for all of our godaddy codes in offers."

" So I'd been in into my laptop I put in my encryption password -- my -- usual when it happens weren't I'm logged in you know everything's. Just fine everything's encrypted it -- nobody can feel my face. I -- to get my -- I come back. What happened."

" But if so what I have to US Packard is taken up. And it's running and I'm just gonna go ahead -- time in the USB key here. And then. I am going to do it pop the battery back -- very quickly. Probably quicker than that and and present power button and then on your computer. Let's do is press F twelve. But times this -- and use the there you go. It starts dumping memory wow. So I understand that let it do its thing there but yeah okay so. It takes a few minutes right so if you're just got I think she I -- that's the last round right -- my. I mean it and different schools take the amount of time different ones are more sophisticated than others I'd like USB one just because of rights to its own memory. Or you know you don't have to set the network that he -- The idea that especially specially crafted motherboard they carry around like that. You know. Sent this a few minutes this USB keys. How do you build it how to make this thing. But if so the who. The person that I'm running and and I think with the big through security. Random result but the reason I'm using is one really a Princeton. -- tech researchers and it's. Now the code is really easy download all your view is pilots there's a note that. It weighs. That you need if you're compiling with GCC four point one relating yet to use. A new stack protector -- let's. All all have. You know information about that but it basically. Yeah you have to get files and once you do what happens is. The package -- comes with a little thin flat and -- and file they use DDT. Image onto your flash drive. So that is bootable. And then that's pretty much it that's that's the pool in a nutshell in doing USC style -- now. -- But once -- that we just an adult art argument here we -- 30% and so we are ready data that's taken right. And and that's it now once that's gonna take that unit start. On Monday and I've got a copy of your Mac. Kennedy that he. You'll like it or -- images and things like that basically. I just like you would have to take with you click forensics analysis and stuff and he and that's that's in your memory. I can get so actually cheaper room called foremost. You know -- burns like a magic rescuers and descent text editor to extract data from within memory so I'd like you. For -- because it supports a lot of different file formats it's tags documents stuff like that. And -- whatever was in ram I just you run it against this tool and that makes you know copy of it proud of that memory dump. And then there's this there's and again it over this but the researchers. R&B S and and Horace today. Keep dumping -- keep finding utilities so. -- when you build your -- your TrueCrypt boy you're Apple to speakers and it is yet to -- as well that's this program implying that. Yeah strings and the like hey you know longhorn is it -- the strings and says hey that's what I'm Xbox. And that. Yeah and it makes you wonder really you know -- use. Yes blue fish and then 3-D yes I get -- way to get all. -- there's a good start stacking correction you know hey you think eventful ones are. So I need your crazy having layers. Or and others like puppet strings -- that the program is like Linux you can use the bird strings tight -- and look for something within your disk image though. Companies username was there's something like that. Yeah I could potentially clintons -- nation's streams. Basically. It's data mining hit -- analysis you know use the same chemicals you use recovers from your hard drive or something. She basically told me that. You know my encryption is worthless it now it -- and this -- and it's it's it's a layer of your defense and that bear in mind physical security in mind you know. When somebody has physical access your machine all bets are off those that's -- is justice. Keep my computer close -- What I mean that is a remedy as well as -- looking into some -- and encryption so rather than to say yes music like I said. Yes yes excuse whatever. In combination. There's also. As far as like an -- wanting to talk Fella here right where you you can keep you warm room and -- Excellent show on -- so but. There's something to be said about it like an enterprise buyer would constantly servers. Servers typically ECC memory. I've talked about this recently when we filthy 2000 dollar or white box. That's because -- on the motorcycle now. And and we what -- desktop memory and it just it just reboot the computer -- has gone down or it turns it off but got got to the in the."

" We'll right well now this brings up another question it's free minute not gonna know I come back my computer and revisit."

" Yeah and also that they were running windows well I -- back to the computer who created what could have possibly happened quietly get it -- what I had in my parents with a helpful."

" A full battery act that was perfectly fine when I left it here with -- of course you could be that's that's us and our viewers -- Yeah so what about lake what is happening hibernate. A good point you're right."

" Hibernate and suspended in some cases life -- you keep the ram it -- keep the encryption key in memory. So. I knew that it here 800 vendors and security software. But yes if you were in suspended IQ you know. But -- what they Acer aspire wants that in your Apple laptop hard to. Memory but if I could act quickly and get some compressed air and light you know slowed down up against my specially crafted motherboard with yeah. And share. I don't think that's his rifle and then there's -- saying in the enterprise environment where servers. -- easy CC unity and smaller. White box here. But if we did it's more expensive memory a lot of times what this or is -- servers when they are revisited. They actually scrub the ECC memory or zero out all of the debts so it's that may be some that may be. That's an insulator defense that's the idea that something to consider it and -- really have to get around -- that's why it's nice to be it would take the -- put it on your. Furthermore. If somebody wants to take the memory out of your server put -- in their -- motherboard doctor ram and they like it that'd be a senator. You might want to use alarm. It's. Through a lot of server it's. The ability to settle. Alarms. They get out and if they get opened it would basically tells motherboard and hopefully that. -- We have an entire conversation about the team servers and rotating -- memory and back powering stuff concealing servers. It's I would find something fantasy. To take a mine and and I I find that there's a lot of fun things that can be not not even just. Encryption in certain stuff that -- mind that of the data that's in your memory when you that's really -- man so I -- next week we will."

" Hello pro computer it just so we can freeze the area and taken out -- another computer it's still -- in."

" And then we can take that memory that we don't and included on the form and -- the kids would try out different Hamas isn't. I don't mind have ethernet --"

" And didn't get through get -- here so well of the story don't leave your computer and build on top into the encryption difference science. I think that."

" I want to let everybody knows that. -- on its service. They are the largest online video game rentals service and offer a choice over 6000 new and classic titles across all councils and -- we plants are you 1595. -- game -- members can rent one -- four games at a time and keep them for as long. As life you can also purchase a game if you fall in love with it spills into the box and manual. Pornography. And on over to gain slide dot com slash Hak5 to get. Two week free trial versions -- dot com slash."

" It's. Little does dummies they're just like standing there Atlantic. And London. -- clear Brookner. One brains."

" So is this it's there's our expert. Yes that well do you have a problem where you're playing counterstrike source and you wanna I don't know hit alt tab in going to hire seat. And then you come back to your game and it's completely frozen and -- you very died as somebody got a head shot already. Your dad's saying it's nothing is really old airline. Yeah. No actually."

" And let -- take zero point nine when I first started playing competitively. Plans we section removed when these keys from keyboards. Or -- Happen just because you press that in my game you can sound how badly I have. And then you."

" Well now you don't have to worry about that whether it's -- aim or some other game. I you have to do is download play expert and you get. You get Twitter you get Gmail and get him or he got all sorts of little widgets inside your game which don't screw up your performance too much and you're -- ago you never have to leave your game. So this is just yours even ask these games has easily -- Definitely let's that's what's with anything cable. You said Gmail literally easy widgets are these something that I don't want to. -- There it comes with like six or seven different widgets are ready packed inside of it which you can remove if you want to keep my captain just for this. For the assignment but it also comes with like fifteen other ones that you can download separately and include into play an expert that way. I'm so -- door opened up here a command prompt. My voice control. Friends. Gmail and PC diagnostics so. Has actually like to -- afterwards and he is an awesome that's so yeah since there are boxes and we got back -- Now let's see here's Firefox and Firefox kill the process yes. That it's gone it's. Singer built. You're not worth it for -- yet -- in cool. So you gotta like games like god what's taking up so much memory so you can open up as closed when every need to pack -- steam whenever I eat it well log me in. -- need them running iTunes over. Like if it here until -- Chico saying you can just coming here and as I keep finding it go and play episode -- it's like yes you Logitech he would like all the actually. It was okay. So I play a key binding to each of my little widgets so all I have to do is press line and in. And look at that I can see my PC diagnostics in the eyes again. So we're gonna look -- memory usage yet you can play. With this for awhile. I think it's not -- it easier to use it. Well I was working yes working very very hard I and it will how hard is -- computer. It's working pretty hard I mean obviously I don't have the best computer in the world and it keeps you running right I didn't -- video card yet. Well first foreplay expert in the a couple of things core two duo as -- recommendation. Along with two gigs of ram and and your graphics card means the you know PCI express -- that. For my computer my performance is pretty dead except when I open Twitter in the tunes widgets. Whenever I try to open the Twitter widget. I had -- running in the background I gave I didn't play expert my username and password so I can tell Twitter whenever I start making and name. But if I try to Twitter it through the Twitter client while it in the game and you my 140 characters personal ones. It completely freezes well and -- will objecting. He adds it's -- is that in the -- and doesn't work too well because I why he's iTunes so anytime I open that up. Guys who runs iTunes and I you know Nancy. It -- yes so what that don't I didn't try pandora and indoors for going to -- them like. And it's. Playing my game that's simple put my music in the background CI."

" And Natalie wonders right and know how -- this -- and another monitor. One. Yes -- tires easily and once the athletes would want to go there it types. This is me greatly especially CS where you get killed."

" You've gotta wait around -- everybody else -- Elliot lake street for a minute I or anybody else finishes their match and you get to go back into the game well why awaiting you can browse the web."

" These would -- it's the high school is where you just write JavaScript."

" All -- TC Sharon and Microsoft visual studios so they're a little bit more errant proprietary and he asked. Fern developers you know anybody -- didn't develop their own widgets for this it's not just the play expert people -- If you want to develop a widget where you can you might go ahead redhead it's fully -- back."

" I think there wraps up this episode I thought it."

" And of course you guys have any questions or comments about it this if you've seen on the show this week ahead posts in the -- this up on the comments and blog you know he's backpack -- better or. We love it here -- guys think it will take some of the stuff then did a the lab next week we'll -- after."

" And don't forget we're haven't hack -- on August 15. Gonna Hak5 -- up dot Squarespace dot com to find out all the details at Busch Gardens Williamsburg yes with the Newfoundland."

" But the guys as -- out there so that we can all together. That's the tech."

" Kids."

" Just look at me like. The bathroom you lady."

Please visit the sponsors of this episode. Interested in more Revision3 special offers?

Go Daddy

Transfer your domain to Go Daddy for as little as $6.99 and get a free 1-year extension plus guaranteed renewal pricing! GoDaddy.com makes transferring easy and offers loads of extras including: hosting, a 5-page site builder, complete email, total DNS control and more! What are you waiting for?

Use the code Hak2 when you checkout to get $5 off any order $30 or more.

Gamefly

Gamefly is the largest online video game rental service and offers you a choice from over 6,000 new and classic titles across all consoles and handhelds. With plans starting at $15.95/month, Gamefly members can rent 1 to 4 games at a time and keep them for as long as they'd like. There are no late fees, no due dates, and shipping is always free. Once you're done playing a game, send it back, and Gamefly will send you the next available game on your list. If you really like the game you're playing simply click 'Keep It' on the Gamefly website and the game is yours at a discounted price. Gamefly will even mail you the case and manuals free of charge.

As a Hak5 fan you can get a 2 week free trial at www.gamefly.com/hak5

Squarespace

Squarespace is an extremely easy to use, fully hosted, completely managed environment for creating and maintaining a website, blog or portfolio. Its intuitive format and features let you be as simple or as sophisticated as you want in the way that you organize your content, no matter what it is your website calls for. Either way, you'll end up with a website that looks like you paid thousands of dollars to design it for you. For plans starting at $8 dollars a month, Squarespace is a deal you can't beat.

Check out using the code Hak5 to get 10% off the lifetime of your order.
mari1ee

Started discussion: July 1, 2009 @ 9:44am GMT

Episode 520: Encrypt your entire hard drive! [Discussion]

What's your best defense against a boot CD that breaks Windows passwords in two keystrokes? Encrypting your entire hard disk. Shannon's got the details on truecrypt drive encryption while Darren brings up plausible deniability with hidden volumes.

Watch or download the episode now!

AbsoluteMayheM
5 months ago
Great ep! I dont use drive encryption, but i just might start!

Its also a good idea for USB keys as well.

Speaking of security I do use an application called KeePass Password Safe and I have been using if for a very long time.

I have all my banking info in it, I have all my work administrative passwords and even stuff like my WoW accounts info and serial number info.

-MayheM
MasterQ
5 months ago
I love that you guys were drinking yuengling... i live close to the brewery where it is made (oldest brewery in the US)... tasty stuff. it's good to see u representing the east coast :)
speed
5 months ago
I posted this on the Hak5 forums as well, but I figure I may as well get, err.... corrected by two groups of users:

I see a couple of problems with the whole "plausible deniability" thing with TrueCrypt. First of all, you'd have to give even the fake folder a decent password (not some lame one as Darren did on the show) in order for it to be believable (right, the password to all your financial documents is "hunter2", sure....); second, in order for you to have a believable fake hidden file, the information has to look like you'd want to protect it (fake banking information or confidential documents), but more often than not, you'd have to include a date somewhere ("July 2, 2009: $300 ABM withdraw at 2:48am" or "January 15, 2000: subject appears restless") and if someone sees this and sees that the information is old, they might get suspicious. However, you can't update the fake files since TrueCrypt warns this can damage the inner volume. Third, at this point, if someone sees that you have an encrypted file on your computer, wants the information that badly and sees that you have TrueCrypt on your HDD, won't they just assume you have a hidden volume and any claims otherwise are fraudulent? I know if I was going to (hypothetically, of course) torture someone for the password to a TrueCrypt volume, I'd keep torturing them for a password until the volume type was listed as "Hidden".

And I'm now prepared for the barrage of replies telling me why I'm way off base on every single point.
MasterQ
5 months ago
In reply to speed:
I posted this on the Hak5 forums as well, but I figure I may as well get, err.... corrected by two groups of users:

I see a couple of problems with the whole "plausible deniability" thing with TrueCrypt. First of all, you'd have to give even the fake folder a decent password (not some lame one as Darren did on the show) in order for it to be believable (right, the password to all your financial documents is "hunter2", sure....); second, in order for you to have a believable fake hidden file, the information has to look like you'd want to protect it (fake banking information or confidential documents), but more often than not, you'd have to include a date somewhere ("July 2, 2009: $300 ABM withdraw at 2:48am" or "January 15, 2000: subject appears restless") and if someone sees this and sees that the information is old, they might get suspicious. However, you can't update the fake files since TrueCrypt warns this can damage the inner volume. Third, at this point, if someone sees that you have an encrypted file on your computer, wants the information that badly and sees that you have TrueCrypt on your HDD, won't they just assume you have a hidden volume and any claims otherwise are fraudulent? I know if I was going to (hypothetically, of course) torture someone for the password to a TrueCrypt volume, I'd keep torturing them for a password until the volume type was listed as "Hidden".

And I'm now prepared for the barrage of replies telling me why I'm way off base on every single point.


The trick is that it's called _plausible_ deniability, meaning they can't prove that there is another volume in there. There is no way for them to distinguish a hidden volume from the random data truecrypt puts in the empty part of the file.

Even truecrypt itself can't tell if there is a hidden volume present. It simply tries to decrypt the file with every algorithm with the password you give it until it gets one that works. If it can't, it tells you either the password isn't correct or the file is not a truecrypt volume.

Your files can be old and the person trying to get in can be as suspicious as they want. Without the password you won't be able to find the hidden volume. Also, there's no security measure you can take that will protect against a person giving someone the key, so theres nothing that will protect against the torturing scenario you mentioned.
speed
5 months ago
In reply to MasterQ:
The trick is that it's called _plausible_ deniability, meaning they can't prove that there is another volume in there. There is no way for them to distinguish a hidden volume from the random data truecrypt puts in the empty part of the file.

Even truecrypt itself can't tell if there is a hidden volume present. It simply tries to decrypt the file with every algorithm with the password you give it until it gets one that works. If it can't, it tells you either the password isn't correct or the file is not a truecrypt volume.

Your files can be old and the person trying to get in can be as suspicious as they want. Without the password you won't be able to find the hidden volume. Also, there's no security measure you can take that will protect against a person giving someone the key, so theres nothing that will protect against the torturing scenario you mentioned.


That's my point though. Can they prove that there's a hidden volume? No. However, if they know even a little bit about TrueCrypt, they aren't likely to believe that the first password you give is legit unless TrueCrypt says the decrypted volume is a hidden one. The whole point of plausible deniability is that if you are forced to relinquish the password, you give them the password for the outer volume. However, that benefit is gone if the person has heard of TrueCrypt.
computoman
5 months ago
It is amazing what you can do by just hiding things in plain sight. You just have to be inventive the way you store files encrypted.
bobo99
5 months ago
hey, guys, cool episode, but i think that some viewers would find it cool to talk about the strength of the various encryptions and hashes and how long it would take to crack (with various cracking techniques) them!
MasterQ
5 months ago
In reply to computoman:
It is amazing what you can do by just hiding things in plain sight. You just have to be inventive the way you store files encrypted.


Truecrypt is not hiding things in plain sight. Hiding things in plain sight would be like renaming a file to have a jpeg extension and putting it in your pictures folder.

In reply to bobo99:
hey, guys, cool episode, but i think that some viewers would find it cool to talk about the strength of the various encryptions and hashes and how long it would take to crack (with various cracking techniques) them!


The US government uses AES for top secret file encryption because it takes a VERY long time to crack if it has a good key (which truecrypt will warn you about if yours is too short). Encrypting using two or all three of the algorithms makes it virtually impossible to crack any time soon (like in this lifetime)
computoman
5 months ago
I never said that truecrypt was hiding things in plain sight. Renaming a file is an oversimplified way to hide a file in plain sight. There are also more sophisticated yet very simple ways to hide things in plain sight other than just embedding an encrypted file in to a picture or the like.
I see no sense in encrypting a whole drive when usually the size of the sensitive data is only a fraction of that. During WWII, American Indian dialects were used to transmit messages. No encryption was necessary per say, except for using non traditional keywords. Security by obscurity.
View all 10 comments