Businesses at risk of data theft through 'classic' cold boot attack

F-Secure warns sensitive data can be scalped from the RAM of lost, stolen or recycled laptops

Thief stealing laptop from car

Most modern computers have a weakness that allows hackers to steal encryption keys and other sensitive data, according to new research.

Cyber security firm F-Secure said it had managed to revive a decades-old attack that involves stealing user data during a computer's reboot process, warning that the majority of modern-day computers are vulnerable to the exploit.

The exploit, known as a cold-boot attack, which has been known to hackers since 2008, involves rebooting a computer without initiating a proper shutdown process, then scalping the residual data that briefly sits on the machine's RAM. While most modern laptops have been designed to overwrite this data by default, the research team was successfully able to disable this overwrite function.

Researchers warn that the attack could mean that businesses risk losing data through machines they have either lost or ditched in recent replacement cycles, and that current security measures are not good enough to protect against the exploit.

"Typically, organisations aren't prepared to protect themselves from an attacker that has physical possession of a company computer," said F-Secure principal security consultant Olle Segerdahl.

"When you have a security issue found in devices from major PC vendors, like the weakness my team has learned to exploit, you need to assume that a lot of companies have a weak link in their security that they're not fully aware of or prepared to deal with."

F-Secure said that although the exploit requires some extra steps to the classic cold boot attack, it's proven to be effective against every modern laptop tested. It added that because the threat is typically used against devices that are stolen or lost, hackers have plenty of time to execute the attack.

Segerdahl also added that there's no reliable way for organisations to know their data is safe if a computer goes missing, and because nearly all company laptops will have things like access credentials for corporate networks, it gives attackers a consistent and reliable way to compromise corporate targets.

Rather worryingly, there is no easy fix for this issue either, but Segerdahl stressed the importance of invalidating access credentials once a machine is reported lost, stolen, or no longer in use.

When contacted by IT Pro, Microsoft senior director Jeff Jones said: "This technique requires physical access to a target device. We encourage customers to practice good security habits, including preventing unauthorized physical access to their device." Crucially, however, there was no mention of a potential fix for the problem.

F-Secure's advice is for businesses to configure laptops so they automatically shut down or hibernate instead of entering sleep mode, or require employees to enter an encrypted system's BitLocker PIN each time they boot up their machines.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021
Report: Security staff excluded from app development
cyber security

Report: Security staff excluded from app development

20 Jan 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

20 Jan 2021
SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021