On the Mark

Yesterday morning was just beautiful.

I awoke to the warm breezes of Orlando, Florida and a dull ache in my back from holding a 29-pound vibrating child waiting to meet the King. No, not Elvis. He’s dead. (ask me about my sister Laura’s Elvis story sometime).

I’m talking about the real King…Mickey Mouse.

This morning, not so beautiful.

I awoke to the frigid cold and a snowstorm pounding New York, and now have an aching back from shoveling and pushing my snow blower up and down the sidewalks of my house and my neighbors’. It hasn’t let up yet and I’ve two rounds of snow-blowing, two rounds of sprinkling rock salt, or whatever it is, AND one snowman under my belt.

Yikes, this storm may be a big one.

Anyway, apparently my back isn’t the only thing that cold has a bad effect on. All this time we’ve fancied ourselves as super-smart in using encryption to stop unwelcome eyes from seeing our important data. Without encryption, things could be very scary for so many e-scenarios, it’s mind-boggling.

In his New York Times article today, John Markoff writes about The Center for Information and Technology Policy, Princeton University’s recent work in demonstrating how cold temperatures affect data and encryption efforts. This is really great stuff.

Edward W. Felten, one of nine individuals who performed the study, discusses it on his Freedom to Tinker blog. Both sites are great reading for folks like us (geek wannabees) and a must read for the real thing.

Ed blogs, “The root of the problem lies in an unexpected property of today’s DRAM memories. DRAMs are the main memory chips used to store data while the system is running. Virtually everybody, including experts, will tell you that DRAM contents are lost when you turn off the power. But this isn’t so. Our research shows that data in DRAM actually fades out gradually over a period of seconds to minutes, enabling an attacker to read the full contents of memory by cutting power and then rebooting into a malicious operating system.”

I’m not going to get into the e-discovery preservation aspects of this; it seems way beyond “reasonable,” to say the least. But it’s interesting that the so-called experts are wrong, and have been wrong for some time. It may interest you, too.

So, how do we really secure the data now that we know of this issue? Do programmers write to wipe DRAM before a device powers down?

Here’s a scenario: User accesses encrypted data on a server from remote. A large part of that data will live for a short period of time in the DRAM of the laptop or desktop computer used from remote session. I see potential security issues popping up on this one.

Ed blogs further, “. . . if you cool the DRAM chips, for example by spraying inverted cans of “canned air” dusting spray on them, the chips will retain their contents for much longer. At these temperatures (around -50 °C) you can remove the chips from the computer and let them sit on the table for ten minutes or more, without appreciable loss of data. Cool the chips in liquid nitrogen (-196 °C) and they hold their state for hours at least, without any power. Just put the chips back into a machine and you can read out their contents.”

I’m going to close this entry now and reach out to one of our experts over at Seagate Recovery Services for his insight. We’ll pick this up on Monday.

Have a great weekend everybody  — and stay warm.

On the Mark

Trackback URI | Comments RSS