Lest we forget: Cold-boot attacks on scrambled DDR3 memory. (29th March 2016)

• Record Type: Journal Article
• Authors: Bauer, Johannes; Gruhn, Michael; Freiling, Felix C.
• Is Part Of: Digital investigation. Volume 16(2015)Supplement 1
• Page Start: S65
• Page End: S74
• Publication Date: 2016-03-29
• Subjects: Cold-boot memory acquisition -- Scraping -- Scrambling -- Whitening -- Decryption; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2016.01.009
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: As hard disk encryption, RAM disks, persistent data avoidance technology and memory-only malware become more widespread, memory analysis becomes more important. Cold-boot attacks are a software-independent method for such memory acquisition. However, on newer Intel computer systems the RAM contents are scrambled to minimize undesirable parasitic effects of semiconductors. We present a descrambling attack that requires at most 128 bytes of known plaintext within the image in order to perform full recovery. We further refine this attack using the mathematical relationships within the key stream to at most 50 bytes of known plaintext for a dual memory channel system. We therefore enable cold-boot attacks on systems employing Intel's memory scrambling technology.