Reports are flying in over Twitter about the latest Cold Boot attack demonstrations at CanSecWest. Looks like the folks over at Intelguardians are showing practical exploits using different techniques, including USB devices and iPods.
We’ve talked about this before, and it’s time to start asking your encryption vendors for their response.
I’m definitely heading up to Vancouver next year; there’s a lot of great stuff coming out of the show.
<
p style=”text-align:right;font-size:10px;”>Technorati Tags: Cold Boot, Encryption, CanSecWest, Vulnerability
Reader interactions
2 Replies to “Uh Oh- Time To Take Cold Boot Encryption Attacks VERY Seriously”
@Ben – Just to be clear “these attacks” aren’‘t against the encryption itself, they are targeted at the design or implementation *around* the encryption. Cold boot attacks don’‘t break encryption, they break the storage of the key (that then decrypts).
I would partially agree, it may not be good to dictate controls to companies, but as we can see with any one of the regulations/standards, it’s really messy to not dictate controls.
Rich: Given these attacks on encryption, I argue legislatures are unwise to mandate encryption as a data security technique. Pending Michigan Senate Bill 1022 does just that.
From a legal policy perspective, encryption can be a useful tool for data security. But it is not perfect. It is only one tool among many, and lawmakers are foolish to specify which particular tool data holders must use. —Ben