Date: Sun, 5 Aug 2018 23:03:56 -0500 (CDT) From: "Valeri Galtsev" <galtsev@kicp.uchicago.edu> To: "Erich Dollansky" <freebsd.ed.lists@sumeritec.com> Cc: "Valeri Galtsev" <galtsev@kicp.uchicago.edu>, "John Levine" <johnl@iecc.com>, freebsd-questions@freebsd.org, "thor" <thor@irk.ru> Subject: Re: Erase memory on shutdown Message-ID: <62318.108.68.162.197.1533528236.squirrel@cosmo.uchicago.edu> In-Reply-To: <20180806103619.3c8b4cf0.freebsd.ed.lists@sumeritec.com> References: <20180805150241.1E186200349F8E@ary.qy> <4e70e969-14f7-c65d-96d2-dd1610499cd0@irk.ru> <63033.108.68.162.197.1533484522.squirrel@cosmo.uchicago.edu> <20180806073738.6f459398.freebsd.ed.lists@sumeritec.com> <57043.108.68.162.197.1533514207.squirrel@cosmo.uchicago.edu> <20180806103619.3c8b4cf0.freebsd.ed.lists@sumeritec.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, August 5, 2018 9:36 pm, Erich Dollansky wrote: > Hi, > > On Sun, 5 Aug 2018 19:10:07 -0500 (CDT) > "Valeri Galtsev" <galtsev@kicp.uchicago.edu> wrote: > >> On Sun, August 5, 2018 6:37 pm, Erich Dollansky wrote: >> > Hi, >> > >> > On Sun, 5 Aug 2018 10:55:22 -0500 (CDT) >> > "Valeri Galtsev" <galtsev@kicp.uchicago.edu> wrote: >> > >> >> On Sun, August 5, 2018 10:26 am, thor wrote: >> >> > https://en.wikipedia.org/wiki/Cold_boot_attack >> >> > >> >> >> >> The trouble is that erasing RAM on clean shutdown does not prevent >> >> the attacker in the attack as above from still successfully >> >> perform the >> > >> > so, ECC is also here the only possible answer, at least for parts >> > of it. >> > >> > Still, erasing memory when shutting down helps in some cases. I do >> > this on my machines for small parts when a shutdown is detected. It >> > makes at least the most obvious attacks from that side difficult. >> >> Please, correct me if I am wrong in the following: >> >> If the attacker yanks off the power cord, then cold boots off his >> media, your defense/erasure of memory does not protect you against >> this attack. Right? Your defense only helps if the attacker does >> clean shutdown. Right? >> > what is the difference between 'some cases' and 'all cases'? > > If the owner of a machine is not able to stop physical access to a > machine, there will be other ways to attack it. Shutting down a machine > allows a normal owner of the machine to wait at the location as most > owners are not on the run. I do understand every word, but I'm not certain I quite follow what you are saying. On the other hand, I have a feeling that we all are on the same page about physical security. Other nuances of what we do on our machines may be different, and probably will stay without change for each of us. This might be the case when participants of the discussion don't learn any wisdom from each other, and there is nothing wrong about it. Thanks. Valeri > > Erich ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?62318.108.68.162.197.1533528236.squirrel>