Breaching Encrypted Data with a Blast of Cold Air - Blizzard Sector

**NewsDude** · 08-22-2008, 03:20 PM

A group led by Princeton University computer security researchers has found a startlingly simple way to breach encrypted data -- by chilling the computer memory chip that holds it. The technique only requires chilling the chip with a blast of cold air from a can of dust remover sold for a few dollars at major retailers.
This action, described by the group on the Web site of Princeton's Center for Information Technology Policy (http://citp.princeton.edii/memory), takes advantage of a vulnerability of the dynamic random access chip, which temporarily holds data, including the keys to modern data-scrambling algorithms. When the computer's electrical power is turned off, the data and the keys are supposed to disappear. However, the group's technical paper published online explains, standard memory chips actually retain their data for seconds, even minutes, after the power is turned off.
When the chips were chilled using a can of air, the data was frozen in place, enabling researchers to read the keys from the chip's memory.
"Cool the chips in liquid nitrogen (-196 [degrees]C) and they hold their state for hours at least, without any power," Edward W. Feiten, a Princeton computer scientist, wrote in a Web posting. "Just put the chips back into a machine and you can read out their contents."
The researchers used special pattern-recognition software of their own to identify security keys among the millions or even billions of pieces of data on the memory chip.
The discovery could have serious implications for companies and governments that rely on encryption to protect their critical data stored on computers, particularly in portable laptops that are especially susceptible to loss or theft.
"We think this is pretty serious to the extent people are relying on file protection," Feiten told the New York Times.
The team, which included Feiten, five graduate students, and three independent technical experts,...

More...

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

08-22-2008, 03:20 PM	#1 (permalink)
NewsDude Status: *** Elder Join Date: Mar 2008 Location: News Office Posts: 1,884** Tournaments Joined: 0 Tournament Wins: 0 Spent time on board: 0:05:24 Hours Rep Power: 4	A group led by Princeton University computer security researchers has found a startlingly simple way to breach encrypted data -- by chilling the computer memory chip that holds it. The technique only requires chilling the chip with a blast of cold air from a can of dust remover sold for a few dollars at major retailers. This action, described by the group on the Web site of Princeton's Center for Information Technology Policy (http://citp.princeton.edii/memory), takes advantage of a vulnerability of the dynamic random access chip, which temporarily holds data, including the keys to modern data-scrambling algorithms. When the computer's electrical power is turned off, the data and the keys are supposed to disappear. However, the group's technical paper published online explains, standard memory chips actually retain their data for seconds, even minutes, after the power is turned off. When the chips were chilled using a can of air, the data was frozen in place, enabling researchers to read the keys from the chip's memory. "Cool the chips in liquid nitrogen (-196 [degrees]C) and they hold their state for hours at least, without any power," Edward W. Feiten, a Princeton computer scientist, wrote in a Web posting. "Just put the chips back into a machine and you can read out their contents." The researchers used special pattern-recognition software of their own to identify security keys among the millions or even billions of pieces of data on the memory chip. The discovery could have serious implications for companies and governments that rely on encryption to protect their critical data stored on computers, particularly in portable laptops that are especially susceptible to loss or theft. "We think this is pretty serious to the extent people are relying on file protection," Feiten told the New York Times. The team, which included Feiten, five graduate students, and three independent technical experts,... More...