Encrypted Swap
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 6 lines · Eric W. Biederman
So the attacker has two way to attack your machine. Attempt to break in while it is still running. Put in a minimal boot cd and press reset and see how much is recovered. Generally breaking should prove the more fruitful course, but the fact that reset preseves all of the memory, means it simply is not safe for someone to have physical access to your machine while the power is on.
if the machine is on, and you can get close to it, it's probably easier just to use tempest radiation. it will also work at a distance, so it's more likely to be a threat than grabbing RAM chips. a few points:
1. not everyone is going to bring their James Bond RAM Reader (tm) into your building to extract data. a hardcore data thief, maybe, but it's not common equipment. everyone will have access to an IDE or SCSI disk reader.
2. RAM has a short window of oppurtunity. whatever it turns out to be, RAM degrades faster than disk. it's not going to last while you drive it home, unless you have a RAM refresher plugged in the cigarette lighter.
3. encrypted swap is meant for a different threat model. you assume that the attacker might have access to the box at night or over a weekend, while you're away. RAM will be off. if you think someone might be trying to steal your RAM, you need better physical security.
--
"I am a great mayor; I am an upstanding Christian man; I am an intelligent man; I am a deeply educated man; I am a humble man."
- M. Barry, Mayor of Washington, DC
Hello Ted , Thank you for bring us back on topic . I found the disertations on memory a tad enlightening . But I was very interested in the original thread of encrypting swap .
Twyl , JimL
Quoted 17 lines · Ted Unangst
Quoted 6 lines · Eric W. Biederman
So the attacker has two way to attack your machine. Attempt to break in while it is still running. Put in a minimal boot cd and press reset and see how much is recovered. Generally breaking should prove the more fruitful course, but the fact that reset preseves all of the memory, means it simply is not safe for someone to have physical access to your machine while the power is on.
if the machine is on, and you can get close to it, it's probably easier just to use tempest radiation. it will also work at a distance, so it's more likely to be a threat than grabbing RAM chips. a few points:
1. not everyone is going to bring their James Bond RAM Reader (tm) into your building to extract data. a hardcore data thief, maybe, but it's not common equipment. everyone will have access to an IDE or SCSI disk reader.
Quoted 8 lines
2. RAM has a short window of oppurtunity. whatever it turns out to be, RAM degrades faster than disk. it's not going to last while you drive it home, unless you have a RAM refresher plugged in the cigarette lighter.
3. encrypted swap is meant for a different threat model. you assume that the attacker might have access to the box at night or over a weekend, while you're away. RAM will be off. if you think someone might be trying to steal your RAM, you need better physical security.
+------------------------------------------------------------------+
| James W. Laferriere | System Techniques | Give me VMS |
| Network Engineer | P.O. Box 854 | Give me Linux |
| [email protected] | Coudersport PA 16915 | only on AXP |
+------------------------------------------------------------------+Quoted 5 lines · Ted Unangst
1. not everyone is going to bring their James Bond RAM Reader (tm) into your building to extract data. a hardcore data thief, maybe, but it's not common equipment. everyone will have access to an IDE or SCSI disk reader.
Everybody has access to a RAM reader. It is called a "pc". Bring one that has battery power and spare slots to plug the stolen modules into. You don't need Q to do this.
Quoted 3 lines
2. RAM has a short window of oppurtunity. whatever it turns out to be, RAM degrades faster than disk. it's not going to last while you drive it home, unless you have a RAM refresher plugged in the cigarette lighter.
Again, a pc with a 12v adapter is the poor man's in-car ram refresher. :-)
Quoted 4 lines
3. encrypted swap is meant for a different threat model. you assume that the attacker might have access to the box at night or over a weekend, while you're away. RAM will be off. if you think someone might be trying to steal your RAM, you need better physical security.
Exactly.
Helge Hafting