News, info, and opinion by Mac users, for Mac users.

February 22, 2008

security

FileVault doesn’t necessarily make your data safe as houses

Posted Feb. 22, ’08, 8:45 AM PT by Dan Moren
Category | Security

FileVaultYou may think that if you use encryption software on your computer to keep your sensitive information secret and safe that you’re in good shape. And, from the average thief you probably are. But if you’re dealing with the kind of information that’s attractive to those with resources, a substantial loophole may allow your encryption to be bypassed in relatively short order, according to a Princeton University researcher.

See, even if the data’s encrypted on your computer’s hard drive, that information has to be decrypted at some point in order to be read: when it hits your computer’s RAM, it’s in all of its plaintext glory. If someone gets to your computer while it’s running or when it’s only been put to sleep, they can shut the computer off, reboot it from a portable hard drive, and rifle the contents of your memory. Even computer systems that wipe the memory on startup can apparently be overcome by using—I kid you not—compressed air, the same stuff you use to clean your keyboard, to cool the chips, slowing the speed at which the memory is erased.

So if you’re relying on technology like OS X’s FileVault or Vista’s BitLocker, just be aware that it’s not quite the foolproof theft solution that you might think. Cue paranoia…now.


5 Comments

Jack Brewster said:

Yeah, but my MBP runs so hot I'm sure it cooks the bits right off the chips in moments.

February 22, 2008 9:15 AM
Ken said:

Dan: Just check the checkbox labeled "Use secure virtual memory". This will use an encrypted VM file. Problem solved!

February 22, 2008 9:21 AM
Ken said:

Nevermind. (I just read the linked article.) Read directly from the chips??? That's wacky.

February 22, 2008 9:24 AM
will said:

I believe you are still pretty secure if you have enabled the firmware program which does not allow your computer to be restarted of another drive without a password. If the passwords are different should'nt you be immune to such an attack?

February 22, 2008 10:56 AM
Dave-O said:

You seem to describe the data in RAM as vulnerable, the story suggests the entire hard drive is vulnerable because the key to decrypt it is likely in RAM.

February 22, 2008 11:42 AM

Leave a comment

 



Visit other IDG sites: