An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption.

The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off.

  • @IHawkMike
    link
    English
    122 days ago

    Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.

    This is not true.

    You would additionally need to bypass Secure Boot with a separate exploit such as the one in this article (which is mitigated by disabling USB boot) or LogoFAIL to put the TPM PCRs in a state where the keys can be released.

    LUKS2 is no different here as either can be TPM-only or require a separate PIN.

    • @Limonene
      link
      English
      42 days ago

      Yes, assuming it’s durably sealed and tamper-proof. If you have enough physical access, though, you can remove the DRAM and put it in another machine to scrape it. This adds time, but it has been done before. One experiment dipped the DRAM in liquid nitrogen for an hour, and found 0.13% decay.

      • @IHawkMike
        link
        English
        52 days ago

        Yeah you really need a password or TPM PIN protector to protect from cold boot attacks if that is in your threat model.