Crime and the economy

Seems like the prevailing wisdom is that when the economy is in tatters, crime rears up - a negative correlation, if you will. Apparently this is even more true for cybercrime - easier to make a few bucks when folks are scared about their savings, looking for bargains and the always popular, "too-good-to-be-true".

And criminal syndicates are taking advantage of this by providing "help" in ensuring their bank accounts are not in danger, new job opportunities targeting those who might have lost their jobs etc. Just read more of this from news.com.

Larger organizations are also not immune from this - what comes in as malware in only part of the threat and unfortunately seems to be the major focus. And folks are still pushing perimeter security and anti-malware as the main protection against this. I think we should be looking beyond - more defense in depth and more protection focused on the data itself.

Warming the cold boot – a bit of braggin’ from BitArmor

By now, all of you are aware of the attacks on full disk encryption technologies described by Princeton researchers. In short, they describe how one can “steal” the contents of RAM and extract the encryption passwords kept in clear text. The research concludes that almost all disk encryption products have the same fundamental flaw that enables anyone, without custom-built and expensive resources, to gain access to the system. Rich Mogull has a good blog on how one should think through the ramifications.

This is scary news and rightfully so. We have seen encryption vendors approach this differently.

• The don’t-worry, be happy approach: Some claim the attack is so esoteric, the customer need not worry – this is just research stuff.
• Leave it to us approach: Some claim to have solved the problem, but with no indication of what that means or how they do it.
• Increase your complexity approach: Some want you to increase the end-user complexity with process and unnatural actions to solve the problem. Not a good idea – every time we ask the end user to be responsible, we lose control and confidence that it was indeed secure. Transparency is the key to security..

We at BitArmor have taken another approach – the “solve the problem” approach. In fact, we had solved this problem, before it even became a known issue. Our CEO, Patrick McGregor is one of the researchers mentioned in the Princeton paper as having proposed architectural enhancements to prevent (the key word being prevent :))these attacks. From the paper:

“Others have proposed architectures that would routinely encrypt the contents of memory for security purposes [28, 27]. These would apparently prevent the attacks we describe..”

The “others” mentioned above, in case you were wondering, are McGregor et al… Check out his blog on his experience at Princeton...

Sorry if we seem to be bragging a bit – not often does a small startup from steeltown open up such a big can of whupass against a new broad new threat!

We have since applied (we had the technology already for a while) for multiple patents on technologies to solve these and similar attacks. Find out more on the BitArmor website (http://www.bitarmor.com/prevent-cold-boot-attacks/) for a high level look at how we deal with specific cold boot threats.

As soon as we can write up detailed information on exactly how we are dealing with the specific cold boot threats in our FDE (full disk encryption) as well as PFE (persistent file encryption) solutions, we will put it up here. Look for more information next week…

Disk encryption not enough?

Just saw this come off the wire - from news.com on how disk encryption from Bitlocker and Apple's FileVault has been circumvented by a few researchers. If this is as simple as they make it sound, this is a bit worrisome. However, I am not ready to buy this fully, till I understand this a bit more.

For one, I was under the impression that Bitlocker protected against booting via an alternative OS (especially a system with a TPM chip on it) because it can perform bootup integrity checks. The article seems to claim this is one of the ways in... Hmm, not so sure...

Further questions:
Is this attack valid for all authentication scenarios such as TPM+Pin?
How easy is it to scan the RAM on a locked system?

There was another article recently in eWeek that talked about FDE not being sufficient protection. I personally think that we need defense against multiple scenarios - not sure if the defense-in-depth term can be used, but seems to fit the best...

Looking forward to understanding this a bit more...