5

I've seen folks deploying the SED on laptops recently. I've discovered that there is a setting in which you can do a warm boot and NOT require the bootup password to be put in again. Which makes sense given you'd of had to of already logged in at one point.

Question being is that it would seem that there could be a means to trick the bootup into believing it's a warm boot vs hard boot... I've seen cases where you can still get into bios, you can't change the SED password there without knowing it but it does give one the ability to boot off other devices... usb, etc.

Thoughts or am I simply missing how it works and this is a non issue?

Travis Howe
  • 81
  • 1
  • 3
  • If the password is cached somewhere then I would think it might be possible to trick the system. You'd would have to be at the bootloader level though. This depends on how the SED implements its configuration/boot bypass. – RoraΖ Oct 28 '14 at 15:48

1 Answers1

4

TL;DR I expect it to be a non-issue provided both the disk and the BIOS manufacturers know their stuff. Otherwise there's a very slight possibility of it being an issue after all.


The disk encryption password scenario depends on the BIOS. If the BIOS supports the caching feature, then it can cache the password between warm boots, and re-supply it to the drive unit.

Were you to succeed in tricking the BIOS into doing a warm boot instead of a cold boot, normally the BIOS should realize that the password cache is not valid, and lock down, or force a cold boot anew.

The thing that can't be worked around is that the drive can not be successfully decrypted unless the correct password has been loaded into it. In theory the drive should resist an attempt to boot without a valid password. At the very least, being unable to decipher the first sector would make the disk effectively unbootable.

However, if the specific implementation allowed bypassing this (for example, it could be argued that a boot sector is effectively a crib, and so should best be left unencrypted not to provide clues for be-it-ever-so-unlikely bruteforcing), then the system might attempt to boot. The consequences, while unlikely in the extreme, can be serious, all the way up to a permanent data loss due to some disk information being overwritten.

There's also a very slight possibility that what you propose might work.

The volatile memory being used in computers is not actually that volatile, and data have been recovered from RAM chips extracted by powered off computers. Of course the probability of a successful recovery decreases enormously with time (as well as with room temperature - warmer chips degrade faster).

Unless the BIOS performs some kind of scrub, or thorough check, at warm boot too, expressly designed to defeat bit lingering, it is (remotely) possible that:

  • the cached password is actually stored in a BIOS data area, not on the disk
  • the disk does not actively react to power loss or cold boot in any way, in particular by resetting the "PASSWORD REQUIRED" flag.
  • a "cold boot attack" can trick the BIOS into not resetting this area, nor informing the disk of the coldness of the boot
  • the BIOS data area is still intact and readable

If all that were the case, then you could power up the computer, the BIOS would read the password off uninitialized memory, except that it would not be uninitialized - it would contain the previous password. And you would have your SSD readable. If the last condition was not met, the password would be degraded, and you would find the computer unbootable; but no data would be lost (since no disk boot would occur), and you could try again (after the correct password has been entered at least once more).

However, by looking around, it seems that the industry has considered this problem. For example here you can read,

The data encryption key does not leave the drive, hence preventing cooled-RAM attacks...

The feasibility of a "cooled RAM" attack is exactly one of the requisites listed above (cooling the target RAM increases likelihood of its data to remain readable). This means that what the BIOS does is just to inform the disk drive that the boot was warm, not cold. If it was cold and the BIOS lied to the disk drive, this would yield nothing - the fact that the boot is actually cold means that the password is not on the disk (again: unless it is the disk itself that suffers from a cooled-RAM vulnerability), so the boot would proceed and find a unreadable, unbootable disk.

LSerni
  • 22,670
  • 4
  • 51
  • 60