said by amungus :

I'm curious about one thing... why wouldn't Vista's "address space randomization" (whatever it's called...) do any good here? Should that not make it more difficult to find the keys? Could there be any way to sufficiently randomize it such that an analyst couldn't tell which pieces to put back together? Granted, that'd probably take some serious work, but it seems like it might be one way of making things more difficult...

said by Killer Max :

Executives of Microsoft said BitLocker has a range of protection options that they referred to as “good, better and best.” ....
...The Princeton researchers acknowledged that in these advanced modes, BitLocker encrypted data could not be accessed using the vulnerability they discovered.

said by jansson_mark :

Easiest way to clear and wipe RAM is to reboot and let BIOS do the "Power-On Self Test" (POST). It will read/write whole RAM three times. End of game.

said by HA Nut :

To make sure a daft person like me understands... if a user cold boots, allows the PC to go through the normal BIOS POST test, and then does a shutdown without entering any passwords, would the RAM be flushed of any clues? I assume a re-boot would NOT be good enough, since the POST is not necessarily ran?

said by jansson_mark :

Easiest way to clear and wipe RAM is to reboot and let BIOS do the "Power-On Self Test" (POST). It will read/write whole RAM three times. End of game.

Trusted Computing hardware, in the form of Trusted Platform Modules (TPMs) [22] is now deployed in some personal computers. Though useful against some attacks, todays Trusted Computing hardware does not appear to prevent the attacks we describe here. Deployed TCG TPMs do not implement bulk encryption. Instead, they monitor boot history in order to decide (or help other machines decide) whether it is safe to store a key in RAM. If a software module wants to use a key, it can arrange that the usable form of that key will not be stored in RAM unless the boot process has gone as expected [31]. However, once the key is stored in RAM, it is subject to our attacks. TPMs can prevent a key from being loaded into memory for use, but they cannot prevent it from being captured once it is in memory.

said by HA Nut :

if a user cold boots, allows the PC to go through the normal BIOS POST test, and then does a shutdown without entering any passwords, would the RAM be flushed of any clues? I assume a re-boot would NOT be good enough, since the POST is not necessarily ran?

said by ihaddsl :

sure, but how many people are going to
after each shutdown, reboot and let post run (*WITHOUT*) loading the disk encyption keys again when the OS boots up?

said by swhx7 :

An encryption co-processor, with tamper-resistance like the TPM, would avert this problem.

said by dave :

Yes, but leaving your PC powered off for 15 minutes before it gets stolen would seem to do the job just as well.

Which is to say, this is very interesting theoretically, but for most home users, I don't see any practical significance. We're talking about motivated attackers who have physical access to your computer and who arrive determined to capture your RAM content. Maybe law enforcement will come equipped for RAM transplants in some cases.

Even for the laptop-in-car case, it requires motivation and planning. I don't believe that is a factor in most such thefts. Or to put it another way, if you've got data that's worth someone doing RAM scavenging, you should think twice about whether it's appropriate to leave it on a laptop in your car.

Just think "data security requires physical security" and you're protected. This new attack drives another nail (well, perhaps just a wire brad) in the coffin of the idea that someone can have your computer and not have your data.

said by jansson_mark :

If they are smart they WILL do it. It they are stupid, no encryption is going to protect them anyway, so...

said by jansson_mark :

Is there any way to easily overwrite old data in RAM?