up vote -2 down vote favorite
share [g+] share [fb]

Would it provide increased security if I zero-filled the RAM before powering off? If that worked, what similar protection could be applied for sleep mode?

link|improve this question
3  
Zero-filling the RAM when going into suspend-to-RAM is a great idea ;-) – Daniel Beck Nov 4 '11 at 19:07
Is this even a serious question? I'll give a serious answer, I guess. – Rob Nov 4 '11 at 19:10
But The OS needs some data on RAM for the wakeup operation. however that can be saved in the hard disk and reloaded back on wake up. and on power off case. I think I can Patch the Kernel such that It zerofills the RAM after ACPI Off – user36582 Nov 4 '11 at 19:12
Sleep stores EVERYTHING in ram. Hibernate moves RAM to the disc, and sets a flag on the bootsector (something similar to that) to boot the OS from the stored RAM that's on the disc. That's why waking from hibernate takes longer, it has to move from disc to ram. – Rob Nov 4 '11 at 19:17
feedback

2 Answers

up vote 1 down vote

RAM is volatile memory. Nothing is held on power down, so there's no reason to zero it, it does that itself by not having power.

Sleep mode basically just "freezes" the current RAM state. If you zeroed that out, it'd be like rebooting.

link|improve this answer
No Man. Check for Cold Boot attack. It takes time for the DATA to get lost – user36582 Nov 4 '11 at 19:13
1  
"The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents which remain readable in the seconds to minutes after power has been removed." It only works when the attacker pulls the power on it, basically. If that's happening, you're not going to have a chance to zero it anyway. – Rob Nov 4 '11 at 19:16
And it's only effective for a couple of MINUTES, max, unless you have some serious liquid nitrogen equipment handy. If somebody's got you compromised that badly, you have bigger problems. – Shinrai Nov 4 '11 at 19:17
2  
But you can't zerofill the ram if they're doing this. The computer can't predict having the power to it dropped. The best security against this: Don't leave your computer running if you aren't there. If you can't do that, keep the case sealed tight, with no unlocked USB ports. – Rob Nov 4 '11 at 19:22
1  
First thing they teach in IT security: "If a malicious user has physical access to your computer, it is no longer your computer." No amount of digital encryption is going to stop someone with physical access to your working computer. It's like asking, "How can I secure my network against my network admin?" The only definite solution is to deny her physical access. – surfasb Nov 5 '11 at 5:07
show 1 more comment
feedback
up vote 1 down vote

The cold boot attack is scary, but also improbable. Most laptop thieves aren't going to risk permanent hardware damage on their merchandise on the possibility that a) you're using FDE in the first place, and b) you have data worth stealing (and c), most laptop thieves have never heard of "cold boot attack" and don't go to Princeton). Much more likely attack vectors exist that should be prioritized ahead of cold boot, IMHO.

Having said all that, for a discussion of cold boot and mitigations, see here: http://security.stackexchange.com/questions/7299/how-can-the-impact-of-cold-boot-attacks-be-minimized/8641#8641

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.