Connect with us


New Cold Boot Attack Can Unlock Disk Encryption in Nearly All Laptops under 2 Minutes

New Cold Boot Attack Can Unlock Disk Encryption in Nearly All Laptops under 2 Minutes

New Cold Boot Attack Can Unlock Disk Encryption in Nearly All Laptops under 2 Minutes. Researchers at a Finnish cyber-security company, F-Secure, have announced that they discovered a new cold boot hardware technique can unlock disk encryption keys and have access to user data within 2 minutes. This can happen in nearly all computers even those with full disk encryption – Mac or Windows, when someone steals or “borrows” your computer.


This new cold boot attacking technique is a new variation to the traditional cold boot attack, which was developed in 2008 and lets attackers steal the remaining brief information in the computer memory (RAM) after the computer is shut down. The traditional technique abruptly cuts off the power on the computer before attackers can access what’s in the RAM.

IT experts and companies, working as a consortium, were able to protect computers from the traditional threat by developing a technique which overwrites RAM contents when power came back. The consortium, called Trusted Computing Group, was formed by Intel, IBM, AMD, HP and Microsoft, and used a specification called MORlock (Memory Overwrite Request Control), where all information in computer memory would disappear when the system booted.

This occurs even if the attacker acted sufficiently fast to create the lower temperature conditions necessary to access the data in memory.

However, the researchers, Olle Segerdahl and Pasi Saarinen demonstrated the new cold boot technique in a video, where attackers can bypass and disable MORlock by reprogramming the non-volatile part of the memory chip which stores the overwritten instruction. They explained how attackers can enable instant rebooting from an external device (USB stick) as to extract and analyze user information available in RAM.

It’s not еxactly easy to do, but it’s not a hard enough issuе to find and еxploit for us to ignore the probability that some attackеrs have already figured this out,

says Segerdahl in a statement released on Wednesday (13Sept2018).

He added that this may not be too practical on easy targets, but it would definitely be on the attacker’s list of options for a “bigger phish, like a bank or larger enterprise.”

The new cold boot attack works on nearly all computers in sleep mode, since actions like shut down and/or hibernation cut off the power, and cause the residual computer memory to quickly degrade beyond recovery. This is because when the computer is in sleep mode, its state is saved in the RAM which runs in a limited power state to hold information.

Coldboot attacks are a known mеthod of obtaining encryption kеys from devices. But the rеality is that attackеrs can get their hands on all kinds of information using thеse attacks. Passwords, crеdentials to corporate nеtworks, and any kind of data stored on the computer are at risk,

F-secure warns in their blog post.

Because of its volatility in data retention when out of power, the RAM (Random Access Memory) can preserve user information for a couple of seconds, even minutes, under low temperature conditions.



Suggested Course from HackWareNews

Advanced Computer Hardware Modifications: Colder and Faster

Discover Advanced Computer Building Tactics Like CPU Liquid Cooling, Storage RAID, & More



Colder temperatures, faster storage speed, and performance graphics rendering. They’re all crucially important points in computer user experience. Looking to upgrade your computer hardware to achieve any of those points? Here, you’ll learn how to do it all.

  • Access 24 lectures & 0.5 hours of content 24/7
  • Cover the most effective method of CPI cooling: closed-loop liquid cooling
  • Learn about the various tricky aspects about RAID setups
  • Understand how to increase data read/write speeds & prepare your computer for a drive crash
  • Discover the workings of multi-GPU technology to massively enhance your computer’s rendering capabilities


Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.


UK Fines Facebook over Cambridge Analytica Scandal


UK Fines Facebook over Cambridge Analytica Scandal. The UK has hit Facebook a fine of $645,000 for the Cambridge Analytica Scandal. It was revealed earlier this year that they had harvested the personal data of millions of profiles without the user’s consent and used it for political purposes. It is estimated that 87 million users were affected.


The fine has been enforced by the UK’s Information Commissioner’s Office (ICO) and was calculated using a pre-GDPR formula for data breach fines. Using the UK’s old Data Protection Act to fine Facebook, rather than GDPR they can only give a maximum penalty of £500,000, which is equal to what the social media giant earns every 18 minutes.


GDPR rules dictate a maximum fine of 4% of annual global turnover, which would be $1.6 billion. Unfortunately the the GDPR regulation wasn’t in place when the Cambridge Analytica story broke, coming into force in May 2018.


The UK investigation concluded that Facebook’s APIs had been allowing developers access to users information without them providing proper consent, for a long period of time between 2007 and 2014. Once they realized this loophole existed and patched it up, they did nothing to investigate the data compromised or ensure it was deleted.


[FACEBOOK] should have known better and it should have done better… We considered these contraventions to be so serious we imposed the maximum penalty under the previous legislation. The fine would inevitably have been significantly higher under the GDPR

Information Commissioner Elizabeth Denham said in a statement


Facebook has said they are reviewing the ICO’s findings and stated they “respectfully disagree” with some of the report, but admit they should have done more to protect users data. They also added that they found no evidence that British users profile information was shared with Cambridge Analytica.

Continue Reading


Libssh Security Flaw leaves thousands of servers vulnerable to hijacking

Libssh Security Flaw leaves thousands of servers vulnerable to hijacking

Libssh Security Flaw leaves thousands of servers vulnerable to hijacking. A security flaw in libssh leaves thousands, and potentially more, servers vulnerable to an attack. Libssh is a multiplatform C library which allows users to remotely execute programs, transfer files, manage public keys and use a secure and transparent tunnel.


The security flaw, discovered by Peter Winter-Smith from NCC Group, allows a hacker to bypass the authentication process on the servers and gain access to the system without having to enter a password.


An attacker can do this by sending the SSH server “SSH2_MSG_USERAUTH_SUCCESS” message instead of the “SSH2_MSG_USERAUTH_REQUEST” message that a server usually expects and which libssh uses as a sign that an authentication procedure needs to initiate.


The libssh system will treat this message to mean the authentication has already taken place and allow the attacker access to the server. The flaw (CVE-2018-10933) was released in January 2014 in release 0.6.0.


It’s estimated that the vulnerability currently affects at least 3000 servers, however this is based on a small search and the scale of the problem is not yet known. There were concerns that the popular version control site for developers to work collaboratively on projects, GitHub, was affected but they have released a statement denying this. Github claims the way they use libssh means they are not vulnerable to this exploit.


“We use a custom version of libssh; SSH2_MSG_USERAUTH_SUCCESS with the libssh server is not relied upon for pubkey-based auth, which is what we use the library for,”

a GitHub security official said on twitter


The security flaw is only on the server side, meaning users who have a libssh based SSH client installed on their computer will be safe from potential attackers looking to exploit this vulnerability.


While there are currently no public exploits available for the vulnerability, they are easy to put together so these are likely to pop up online in the coming days and weeks.

The team at libssh released versions 0.8.4 and 0.7.6 yesterday to handle this bug.


Continue Reading


Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.


A malicious app called “Album by Google Photos” was found to be hosted on the Microsoft store. The app was pretending to be part of Google Photos, but was in fact an ad clicker that generates hidden adverts within the Windows 10 Operating System.


The ad clicker app seemed credible to users because of its name, and also the fact it claimed to be created by Google LLC, Google’s actual Microsoft store account is Google Inc, but it looks unsuspecting to users. Microsoft came under some criticism for not realising the app was actually malicious software since the user reviews did highlight that the app was fake, with plenty of 1* reviews. One review states “ My paid Anti-malware solution detected several attempts to download malware by this app. Watch out”. The App was first released on the Microsoft store in May.


What did the application do?


The “Album by Google Photos” app is a Progressive Web Application (PWA), which acts as the front end for Google Photos and includes a legitimate login screen. Hidden in the app bundle is also an ad clicker which runs in the background and generates income for the app developers.


The app connects to ad URLS, and the ads were very similar to what users would see from typical adware, including tech support scams, random chrome extensions, fake flash and java installs and general low-quality sites.


Microsoft haven’t commented how this app managed to pass the Microsoft review process before ending up on the store.  This is somewhat concerning since it could mean other malicious apps of a similar nature have flown under the radar and are still infecting user’s computers. We are waiting for Microsoft to comment on the issue.

Continue Reading