Security flaw allows attackers to steal data from almost any computer

A newly discovered security flaw compromises data stored on nearly all computers.

Security researchers from F-Secure, a Finnish IT security company, published their findings this week. The company’s principal security consultant, Olle Segerdahl, told TechCrunch the vulnerability put “nearly all” laptops and desktops at risk. This includes both Mac and Windows.

The exploit is based on a traditional ‘cold boot’ attack, which attempts to retrieve data from a computer that’s turned off. Most modern computers overwrite their memory when powered down. This scrambles the data so attackers can’t read it.

However, Segerdahl and his colleague Pasi Saarinen were able to disable that process.

It takes a few extra steps and requires access to the computer. Furthermore, the F-Secure team has already built a proof-of-concept that prevents firmware from clearing secrets from memory. Then, the researchers will scan for disk encryption keys, which they can use to mount the protected volumes.

Attackers can steal anything the computer has stored in its memory as well, like passwords and network credentials.

There’s little Microsoft or Intel can do

F-Secure shared its findings with Microsoft, Apple and Intel before releasing them.

However, none of those companies can really fix the problem because the flaw is based in the PC manufacturer’s firmware.

According to Segerdahl, Microsoft can’t do anything to remedy the issue. Furthermore, Intel is limited as they provide a reference platform for manufacturers to extend and build new models on.

Manufacturers and companies are “on their own,” according to Segerdahl.

Apple, however, has said it is looking into measures to protect Mac computers. It’s worth noting that Macs with a T2 chip, like the iMac Pro and 2018 MacBook Pro models, are not affected by the flaw.

Microsoft says that using pre-boot authentication like a PIN or startup key can mitigate cold boot attacks. However, this isn’t available for Windows Home users.

Ultimately, the best thing you can do right now is to ensure you’re the only one who can physically access your computer. Furthermore, plan for the possibility of being hacked, rather than assume attackers can’t compromise your device.

Source: F-Secure Via: 9to5 Mac, TechCrunch