Toolkit breaks FileVault and BitLocker

If you rely on encryption technology like Microsoft's BitLocker or Apple's FileVault, you might want to think again: a team of security researchers has released a toolkit allowing popular cryptography packages to be bypassed.

Part of the Memory Research Project at Princeton University, the tools – released in source code form suitable to use on pretty much any architecture of PC once compiled – is an implementation of the techniques uncovered during research into so-called 'cold boot' attacks against cryptographic systems as part of a paper published by the team.

CNet has it that attackers are able to use the code provided to reboot a running system, image the memory to a USB key or via network booting, and extract AES and RSA private keys automatically – even if that particular section of memory has degraded during the reboot.

If true, cryptosystems which keep the key in memory even after it is no longer required are at risk – and that includes the two most popular encryption packages, the shipped-by-default BitLocker that comes with Windows Vista Ultimate and FileVault which comes with MacOS X.

Although data stored in memory degrades when the power is cut, the team discovered that it doesn't disappear as fast as previously thought. Testing with an image stored in memory, the team were able to recover enough data to recreate a recognisable version of the image for almost a minute after power had been removed from the module. By cooling the memory using the compressed gas in a commercially-available 'spray duster' can the team were able to extend this period to several minutes, and by submerging the module in liquid nitrogen this was extended to a period of hours.

This period in which memory retains data stored before power was cut is where the software works: by quickly rebooting the machine and imaging the memory, a program is used to search through the image for AES and RSA private keys that can be used to decode the target files. An additional utility is also available for repairing damage caused to these keys if you didn't get the memory imaged fast enough.

While the research has been reported before, this marks the first occasion that the team has released source code allowing even the relatively untechnical access to the techniques detailed by the team. While it's a blow for people who rely on cryptography to keep their private data private, it's important to note that the attack is hardly subtle – in order to use the programs created by the team an attacker would require local access to the machine, and a reboot is required. It's not something a remote attacker could reasonably achieve, even allowing for the possibility of Netboot code. If in doubt, I'd recommend that you unmount your encrypted drives when they're not in use – and if your data is really private, reboot your system afterwards.

Anybody here fancy compiling the code and seeing if they can break their FileVault or BitLocker encryption, or do we all have nothing to hide? Share your thoughts over in the forums.