无忧启动论坛

 找回密码
 注册
搜索
系统gho:最纯净好用系统下载站广告联系 微信:wuyouceo QQ:184822951
查看: 3644|回复: 4

用内存启动(cold boot)是怎么回事? 内存在关机后还有内容?

[复制链接]
发表于 2009-6-8 11:29:06 | 显示全部楼层 |阅读模式
听说在某一电脑关机后,把它的内存条取出来拿到另一电脑上去,还能启动找到原来的内容,太神奇了,居然还有源代码.

内存我还一直以为是一断电就没了呢



Princeton University Center for Information Technology Policy website describes how the attack is possible:

    Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems - BitLocker, FileVault, dm-crypt, and TrueCrypt - using no special devices or materials. We experimentally characterize the extent and predictability of memory remanence and report that remanence times can be increased dramatically with simple techniques. We offer new algorithms for finding cryptographic keys in memory images and for correcting errors caused by bit decay. Though we discuss several strategies for partially mitigating these risks, we know of no simple remedy that would eliminate them.

Video clip published by the team shows that it’s possible to remove a DIMM from one computer after power loss, transport and traffic the RAM module to another PC, aiding by a typical canned-air spray to lower its temperature to lengthen the time which the DIMM will keep the data, and then boot the computer unit using a specially designed microkernel, and finally dump all data on the RAM chip to physical disk. The amount of bad (decayed) data depended on both the time a DIMM spent unpowered and the temperature at which it was kept. Nonetheless, the researchers managed to successfully reconstruct 128-bit AES encryption keys within seconds, even if 10 percent of the key had already decayed out of memory.

The Princeton University team has also released the source code for some of the software utilities that is developed in the course of this research. These prototype applications are intended to illustrate the techniques described in the encryption keys cool boot attack research paper, and should not be used for malicious or hacking attempt.

The source code for applications released for free download include USB / PXE (bios_memimage-1.0.tar.gz) and EFI Netboot (efi_memimage-1.0.tar.gz) memory imaging tools, AESKeyFinder (aeskeyfind-1.0.tar.gz) and RSAKeyFinder (rsakeyfind-1.0.tar.gz) automatic key-finder tools, and AESFix (aesfix-1.0.1.tar.gz) error-correction utility for AES key schedules.

[ 本帖最后由 我是神仙 于 2009-6-8 11:30 编辑 ]
发表于 2009-6-8 12:07:35 | 显示全部楼层
对头!关机后迅速用液氮将其冷却!然后用这玩意就能找到内存里的数据

不过要快



内存关机后只是断电,并没有清零
那残余的电信号还需要一段时间才能完全over
回复

使用道具 举报

发表于 2009-6-8 12:45:21 | 显示全部楼层
这么强,头一次听到,新鲜;
看来万事皆有可能,真是没说错
回复

使用道具 举报

 楼主| 发表于 2009-6-8 18:09:53 | 显示全部楼层
原帖由 peter1123 于 2009-6-8 12:07 发表
对头!关机后迅速用液氮将其冷却!然后用这玩意就能找到内存里的数据

不过要快




信不信由你
Just Google it

http://www.google.com/search?hl= ... =f&oq=&aqi=

http://citp.princeton.edu/memory ... memimage-1.0.tar.gz
http://citp.princeton.edu/memory ... memimage-1.0.tar.gz





Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard.

和常识相反, DRAM内存中的内存不会很快丢失,即使从主板上取下来都还不一定会丢失.
据说约十分钟吧
回复

使用道具 举报

发表于 2009-6-8 21:43:47 | 显示全部楼层
我没说不信啊!
这个新闻半年前就在cnbeta上放出来了的
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 注册

本版积分规则

小黑屋|手机版|Archiver|捐助支持|无忧启动 ( 闽ICP备05002490号-1 )

闽公网安备 35020302032614号

GMT+8, 2024-3-28 20:47

Powered by Discuz! X3.3

© 2001-2017 Comsenz Inc.

快速回复 返回顶部 返回列表