---
created_at: '2016-06-10T03:05:12.000Z'
title: Cryogenically frozen RAM bypasses disk encryption methods (2008)
url: http://www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/
author: andreyvit
points: 49
story_text: 
comment_text: 
num_comments: 34
story_id: 
story_title: 
story_url: 
parent_id: 
created_at_i: 1465527912
_tags:
- story
- author_andreyvit
- story_11874014
objectID: '11874014'

---
[Source](http://www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/ "Permalink to Cryogenically frozen RAM bypasses all disk encryption methods | ZDNet")

# Cryogenically frozen RAM bypasses all disk encryption methods | ZDNet

This web site uses cookies to improve your experience. By viewing our content, you are accepting the use of cookies. To find out more and change your cookie settings, please [view our cookie policy][1]. 

* Edition: 
    * Asia 
    * Australia 
    * Europe 
    * India 
    * United Kingdom 
    * United States 
    * ZDNet around the globe:
    * [ ZDNet China ][2]
    * [ ZDNet France ][3]
    * [ ZDNet Germany ][4]
    * [ ZDNet Korea ][5]
    * [ ZDNet Japan ][6]

[ ][7]

Search

Go

* [ Videos ][8]
* [ Smart Cities ][9]
* [ Windows 10 ][10]
* [ Cloud ][11]
* [ Innovation ][12]
* [ Security ][13]
* [ Tech Pro ][14]
* more
    * [ ZDNet Academy ][15]
    * [ Digital Transformation ][16]
    * [ Microsoft ][17]
    * [ Mobility ][18]
    * [ IoT ][19]
    * [ Hardware ][20]
    * [ Best VPN Services ][21]
    * [ See All Topics ][22]
    * [ White Papers ][23]
    * [ Downloads ][24]
    * [ Reviews ][25]
    * [ Galleries ][26]
    * [ Videos ][8]
* [Newsletters][27]
* [All Writers][28]
*     * [Log In to ZDNET][29]
    * [Join ZDNet][30]
    * [About ZDNet][31]
    * [Preferences][32]
    * [Community][33]
    * [Newsletters][34]
    * [Log Out][35]
* [ ][7]
*     * Go
* Menu
    * [ Videos ][8]
    * [ Smart Cities ][9]
    * [ Windows 10 ][10]
    * [ Cloud ][11]
    * [ Innovation ][12]
    * [ Security ][13]
    * [ Tech Pro ][14]
    * [ ZDNet Academy ][15]
    * [ Digital Transformation ][16]
    * [ Microsoft ][17]
    * [ Mobility ][18]
    * [ IoT ][19]
    * [ Hardware ][20]
    * [ Best VPN Services ][21]
    * [ See All Topics ][22]
    * [ White Papers ][23]
    * [ Downloads ][24]
    * [ Reviews ][25]
    * [ Galleries ][26]
    * [ Videos ][8]
*     *         * [Log In to ZDNET][29]
        * [Join ZDNet][30]
        * [About ZDNet][31]
        * [Preferences][32]
        * [Community][33]
        * [Newsletters][34]
        * [Log Out][35]
* us

    * Asia 
    * Australia 
    * Europe 
    * India 
    * United Kingdom 
    * United States 
    * ZDNet around the globe:
    * [ ZDNet China ][2]
    * [ ZDNet France ][3]
    * [ ZDNet Germany ][4]
    * [ ZDNet Korea ][5]
    * [ ZDNet Japan ][6]

# Cryogenically frozen RAM bypasses all disk encryption methods

Computer encryption technologies have all relied on one key assumption that RAM (Random Access Memory) is volatile and that all content is lost when power is lost. That key assumption is now being fundamentally challenged with a $7 can of compressed air and it's enough to give every security professional heart burn.

[ ![George Ou][36] ][37]

By [George Ou][37] for [Zero Day][38] | February 21, 2008 -- 23:59 GMT (15:59 PST) | Topic: [Enterprise Software][39]
* [ 0 ][40]
* * * * ![][41]Computer encryption technologies have all relied on one key assumption that RAM (Random Access Memory) is volatile and that all content is lost when power is lost. That key assumption is now being fundamentally challenged with a $7 can of compressed air and it's enough to give every security professional heart burn. 

We all had some theoretical concerns, but surely it would be too difficult to transport hot memory from one computer to another to extract its contents right? That's what we all thought until a [group of researchers from Princeton University][42] showed that memory wasn't as volatile as we had all assumed ([see Techmeme][43]). As a matter of fact, memory would hold its contents for a duration of seconds or even minutes with the power cut off. If that wasn't long enough, a can of compressed air used upside down will cryogenically freeze memory and keep the data intact for several minutes to an hours. This means the ultrasensitive encryption keys used to protect data can be exposed in**![][44]** the clear. 

**Also see: [Images: How to bypass FileVault, BitLocker security][45] **

Most of the time, the compressed air probably isn't even necessary but it can offer a sure way to get the job done since the RAM can be safely moved to a different computer. Once that computer boots up in to a special OS designed for RAM forensics, it is possible to dump the raw contents of memory on to storage. Even if parts of the key were lost due to power-loss decay, a simply exhaustive search should be able to recreate the key. But by freezing the memory, it's unlikely that much data would be lost in the first place. 

This same attack works without the compressed air or RAM migration if the computer is configured for USB or LAN boot. You simply put in a USB dongle and boot off that dongle or you can boot off the network. Booting off the optical drive is probably just as easy and more likely to work. Then you can dump the RAW memory contents to the USB dongle or a network share. If the computer will only boot to the hard drive and the BIOS is locked from reconfiguration, then you might run in to some problems because you've already wasted a minute trying to find all this out but the freeze and memory migrate method gets around any of these boot-up limitations. 

If an embedded TPM is involved, a simple swapping of the hard drive will get around all these problems. Once the raw contents are saved to disk, forensics software can retrieve the keys from disk encryption systems such as Vista BitLocker, Apple FileVault, TrueCrypt, dm-crypt, and potentially a bunch of other data encryption solutions as well. Once is key is exposed, the hard drive might as well not be encrypted at all. 

The challenge we are facing here is fundamentally difficult because the problem stems from a combination of hardware, software, and usability. The software assumes the hardware (RAM) will lose its content as soon as power is lost and that simply isn't the case. RAM is designed to be low power, low latency, low cost, high density, and high throughput but nowhere on that list is "quick to forget when powered off". Even if the memory could be designed to rapidly expire in under a second, -150 Celsius liquid nitrogen can extend that time by orders of magnitude. 

We might design encryption software to flush the key every few minutes when not in use but that gets in to usability issues. No one wants to be forced to pull out a USB dongle every few minutes or have to type in a password to extract the key from the TPM. Sort of a user-friendly transparent proximity solution where the user wears some sort of secure wireless token that can securely hand out the encryption key whenever needed by the push of a button do I see it practical to frequently flush the encryption key from the encryption software. There was little motivation to build such a system but with this latest breakthrough in offensive capability, we might have to consider it. 

### Related Topics:

[ CXO ][46] [ Cloud ][11] [ Big Data Analytics ][47] [ Innovation ][12] [ Tech and Work ][48] [ Collaboration ][49]

* [ 0 ][40]
* * * * [LOG IN TO COMMENT][50]
* [My Profile][32]
* [Log Out][35]

| [Community Guidelines][51]

###  Join Discussion

[Add Your Comment][50]

[Add Your Comment][40]

##  Related Stories

* [ ![MYOB thanks SME segment for AU$60.7m FY17 profit][52] ][53]

Enterprise Software

[MYOB thanks SME segment for AU$60.7m FY17 profit][54]

* [ ![​Show-stopping bug appears in npm Node.js package manager][55] ][56]

Enterprise Software

[​Show-stopping bug appears in npm Node.js package manager][57]

* [ ![HPE delivers Q1 earnings beat, shares up after hours][58] ][59]

Enterprise Software

[HPE delivers Q1 earnings beat, shares up after hours][60]

* [ ![Windows 10 tip: Search for any file by date][61] ][62]

Windows 10

[Windows 10 tip: Search for any file by date][63]

×

#### Thank You

## Please review our terms of service to complete your newsletter subscription.

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the [Terms of Use][64], [Privacy Policy][65] and [Video Services Policy][66]. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services. You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.   
  

ACCEPT & CLOSE

## Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the [Newsletter Subscription Center][34].

[

See All 

][27] [

See All 

][34]

[ZDNet][67]

Connect with us

[ ][68] [ ][69] [ ][70]

© 2018 CBS Interactive. All rights reserved. [Privacy Policy][71] | [Cookies][1] | [Ad Choice][72] | [Advertise][73] | [Terms of Use][74] | [Mobile User Agreement][75]

Visit other CBS Interactive sites: Select SiteCBS CaresCBS FilmsCBS RadioCBS.comCBSInteractiveCBSNews.comCBSSports.comChowhoundCNETCollege NetworksGameSpotLast.fmMaxPrepsMetacritic.comMoneywatchmySimonRadio.comSearch.comShopper.comShowtimeTechRepublicThe InsiderTV.comUrbanBaby.comZDNet

* [Topics][22]
* [All Authors][28]
* [Galleries][26]
* [Videos][8]
* [Sponsored Narratives][76]
* [About ZDNet][31]
* [Meet The Team][37]
* [Site Map][77]
* [RSS Feeds][78]
* [Reprint Policy][79]
* [Manage][32] | [Log Out][35]
* [Log In to ZDNET][29] | [Join ZDNet][30]
* [Membership][80]
* [Newsletters][27]
* [Site Assistance][81]
* [ZDNet Academy][15]

[1]: http://legalterms.cbsinteractive.com/cookies
[2]: http://www.zdnet.com.cn/
[3]: http://www.zdnet.fr/
[4]: http://www.zdnet.de/
[5]: http://www.zdnet.co.kr/
[6]: http://japan.zdnet.com/
[7]: http://www.zdnet.com/ "ZDNet"
[8]: http://www.zdnet.com/video/
[9]: http://www.zdnet.com/topic/smart-cities/
[10]: http://www.zdnet.com/topic/windows-10/
[11]: http://www.zdnet.com/topic/cloud/
[12]: http://www.zdnet.com/topic/innovation/
[13]: http://www.zdnet.com/topic/security/
[14]: http://www.techproresearch.com/
[15]: https://academy.zdnet.com/
[16]: http://www.zdnet.com/topic/digital-transformation/
[17]: http://www.zdnet.com/topic/microsoft/
[18]: http://www.zdnet.com/topic/mobility/
[19]: http://www.zdnet.com/topic/internet-of-things/
[20]: http://www.zdnet.com/topic/hardware/
[21]: https://www.cnet.com/best-vpn-services-directory/
[22]: http://www.zdnet.com/topic/
[23]: http://www.techrepublic.com/resource-library/whitepapers/
[24]: http://www.zdnet.com//downloads.zdnet.com/
[25]: http://www.zdnet.com/reviews/
[26]: http://www.zdnet.com/pictures/
[27]: http://www.zdnet.com/newsletters/
[28]: http://www.zdnet.com/blog/
[29]: https://secure.zdnet.com/user/login/?appId=1101
[30]: https://secure.zdnet.com/user/registration/?appId=1101
[31]: http://www.zdnet.com/about/
[32]: https://secure.zdnet.com/members/preferences/
[33]: https://secure.zdnet.com/members/community/
[34]: https://secure.zdnet.com/members/newsletters/
[35]: http://www.zdnet.com/user/logout/
[36]: https://zdnet1.cbsistatic.com/hub/i/r/2014/07/22/18f3451e-1174-11e4-9732-00505685119a/thumbnail/40x40/1658ad67bd103bfa58c3a7f0e109905c/george-ou.jpg
[37]: http://www.zdnet.com/meet-the-team/
[38]: http://www.zdnet.com/blog/security/
[39]: http://www.zdnet.com/topic/enterprise-software/
[40]: http://www.zdnet.com#comments-a18dfee7-333f-11e4-9e6a-00505685119a
[41]: http://blogs.zdnet.com/Ou/images/memorex_airduster.jpg
[42]: http://citp.princeton.edu/memory/
[43]: http://www.techmeme.com/080221/p95#a080221p95
[44]: https://zdnet4.cbsistatic.com/hub/i/r/2014/10/04/bedf805a-4b65-11e4-b6a0-d4ae52e95e57/resize/270xauto/638f24ddb077996caac7727a18c27cee/189069-525-349.jpg
[45]: http://content.zdnet.com/2346-9595_22-189068.html?tag=gald
[46]: http://www.zdnet.com/topic/cxo/
[47]: http://www.zdnet.com/topic/big-data/
[48]: http://www.zdnet.com/topic/tech-and-work/
[49]: http://www.zdnet.com/topic/collaboration/
[50]: https://secure.zdnet.com/user/registration/?appId=1101&redirectUrl=http%3A//www.zdnet.com/article/cryogenically-frozen-ram-bypasses-all-disk-encryption-methods/%23comments-a18dfee7-333f-11e4-9e6a-00505685119a&showUserName=1
[51]: http://cbsi.force.com/CBSi/zdnetcommunityfaq
[52]: https://zdnet4.cbsistatic.com/hub/i/r/2017/08/24/e76fa8b9-80b9-4b64-8bee-9bf9a53fcca6/thumbnail/170x128/1ec672d61221d264840ab00aefb98cb6/myob.png
[53]: http://www.zdnet.com/article/myob-thanks-sme-segment-for-au60-7m-fy17-profit/ "MYOB thanks SME segment for AU$60.7m FY17 profit"
[54]: http://www.zdnet.com/article/myob-thanks-sme-segment-for-au60-7m-fy17-profit/
[55]: https://zdnet2.cbsistatic.com/hub/i/r/2018/02/16/29c39d3d-2dd1-492c-8fc2-d21aa1a20df6/thumbnail/170x128/60d99de28c12626be0c2f6dee5de8b44/istock-873597792.jpg
[56]: http://www.zdnet.com/article/show-stopping-bug-appears-in-npm-node-js-package-manager/ "​Show-stopping bug appears in npm Node.js package manager"
[57]: http://www.zdnet.com/article/show-stopping-bug-appears-in-npm-node-js-package-manager/
[58]: https://zdnet1.cbsistatic.com/hub/i/r/2017/09/22/7ef92304-456f-4172-b826-8561539cb49b/thumbnail/170x128/abdf6d5a3c3abc7873660918152f1984/hpe-sign-hq.jpg
[59]: http://www.zdnet.com/article/hpe-delivers-q1-earnings-beat-shares-up-after-hours/ "HPE delivers Q1 earnings beat, shares up after hours"
[60]: http://www.zdnet.com/article/hpe-delivers-q1-earnings-beat-shares-up-after-hours/
[61]: https://zdnet3.cbsistatic.com/hub/i/r/2017/10/25/cdfceaa9-538b-49f4-979e-341fba0e007c/thumbnail/170x128/111c7f9cdde1da0a3b1548af4f8faec8/ci0qa2bugaaqwg.jpg
[62]: http://www.zdnet.com/article/windows-10-tip-search-for-any-file-by-date/ "Windows 10 tip: Search for any file by date"
[63]: http://www.zdnet.com/article/windows-10-tip-search-for-any-file-by-date/
[64]: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
[65]: https://cbsi.secure.force.com/CBSi/articles/FAQ/Privacy-Policy?categories=CBS_Interactive%3AmPrivacy&template=template_mobilePrivacy&referer=mobileprivacy.com&data=&cfs=default
[66]: https://cbsi.secure.force.com/CBSi/articles/FAQ/mThird-Party-Social-Networking-Services?template=template_mobilepp&referer=mobilepp.com&data=&cfs=default
[67]: http://www.zdnet.com/
[68]: https://www.facebook.com/pages/ZDNet/5953112932
[69]: http://twitter.com/zdnet
[70]: https://www.linkedin.com/company/zdnet-com
[71]: http://legalterms.cbsinteractive.com/privacy
[72]: http://legalterms.cbsinteractive.com/adchoice
[73]: http://www.zdnet.com/advertise/
[74]: http://legalterms.cbsinteractive.com/terms-of-use
[75]: http://legalterms.cbsinteractive.com/eula
[76]: http://narratives.zdnet.com/
[77]: http://www.zdnet.com/sitemap/
[78]: http://www.zdnet.com/rssfeeds/
[79]: http://www.zdnet.com/reprints/
[80]: https://secure.zdnet.com/members/
[81]: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com

