Does Symantec Endpoint Encryption protect against the "Cold Boot" attack?
search cancel

Does Symantec Endpoint Encryption protect against the "Cold Boot" attack?

book

Article ID: 177954

calendar_today

Updated On:

Products

Endpoint Encryption

Issue/Introduction

You wish to know how Symantec Endpoint Encryption protects against the "Cold Boot" attack.

For current status on Cold Boot as it relates to both Symantec Endpoint Encryption 11 and Symantec Encryption Desktop 10, see article INFO5209.

Cause

The "Cold Boot" attack is a way to bypass software-based Full Disk Encryption (FDE) by using the basic characteristics of DRAM found in all PCs. A method to achieve this was published by Princeton University researchers in February 2008.

Resolution

Cold Boot Attack 1

The "Cold Boot" attack is a way to bypass software-based Full Disk Encryption (FDE) by using the basic characteristics of DRAM/SRAM found in all PCs. 2   A method to achieve this was published by Princeton University researchers.3
 
Specific Protection against the "Cold Boot" or Princeton class of attack has been added to Symantec Endpoint Encryption (SEE) since SEE Full Disk v7.0. This protection is optional, but is enabled by default. This protection ensures that cryptographic key information cannot be retrieved from RAM after shutdown or hibernation.
 
Users of the Symantec Endpoint Encryption version 8.x product are advised that AES symmetric keys are not loaded into memory until the user authentication step has been completed. This step is required when the machine is either coming out of hibernation or being booted from a shut down or cold state. Also, even if the Symantec Endpoint keys are accessed in memory, a unique AES initialization vector still needs to be created to encrypt or decrypt each sector of the disk.  Because of this, the attacker would need to figure out the seeding algorithm and key expansion methodology to recover data from the disk – making compromise of the Symantec Endpoint 8.x product highly unlikely. 
 
Nevertheless, Cold Boot is primarily a hardware attack and SEE full disk encryption could be as vulnerable as any other vendor’s full disk encryption products.   As an extra precaution, Symantec recommends security administrators to perform the following steps to limit the attack surface:
 
  • Disable the “standby” function on PCs so that all machines are powered down when they are turned “off” (either via “shut down” or “hibernate” in Windows parlance)
  • Restrict the ability to boot from removable media by taking steps such as requiring an administrative password to change the boot sequence in BIOS to allow boot from sources other than primary drive
  • Use machines with BIOS that tests and initializes the memory through “power on self test”
  • Physically secure DRAM to the machine to make it difficult to remove quickly and without damage
  • Do not leave machines unattended, accessible to other, etc.
  • Always deploy the latest version of the encryption software
  • Never disable Pre-Boot Authentication permanently unless physical protection of the device is assured
Symantec Corporation is willing to work with any hardware manufacturer who makes CPUs, chipsets, or SRAM/DRAM to construct ways to solve the issue at its root. This is an attack on the hardware itself, and consequently, a complete solution must come from hardware. Software solutions can make the situation better, but cannot completely correct this issue.
 
Given the complexity of today’s threat landscape, Symantec urges our customers to enable Pre-Boot Authentication to ensure maximum security.
 

 

 

 

 

Powered by Wolken Software