Security Flaw Discovered in Nearly All Macs and PCs

Security Flaw Discovered in Nearly All Macs and PCs

A new vulnerability brings back the risk of a cold boot attack.

In new findings published last week, F-Secure said that no modern device, Macs and PCs alike, do not have existing firmware security measures that "do a good enough job" preventing a new attack that can steal sensitive data in a matter of minutes.

F-Secure principal security consultant Olle Segerdahl explained that the vulnerabilities put "nearly all" laptops and desktops at risk.

The new exploit is built on the foundations of a traditional cold boot attack, a technique that is well known in the hacking community. Modern computers overwrite their memory when a device is powered down to scramble the data from being read. F-Secure believes they have found a way to disable the overwriting process, making a cold boot attack possible again.

"It takes some extra steps," Segerdahl said. "But the flaw is easy to exploit."

So much so, that it would "very much surprise" him if this technique isn't already known by some hacker groups.

It is no secret that if you have physical access to a computer, the changes of someone stealing your data is usually greater. That's why so many use disk encryption, like BitLocker for Windows and FileVault for Macs, to scramble and protect data when a device is turned off. The researchers, however, found that in nearly all cases, they can still steal data protected by those programs.

After the researchers figured out how the memory overwriting process works, they said it took just a few hours to build  a proof-of-concept tool that prevented the firmware from clearing secrets from memory. From there, the researchers scanned for disk encryption keys, which, when obtained, could be used to mount the protected volume.

It's not just disk encryption keys at risk, Segerdahl said. A successful attacker can steal "anything that happens to be in the memory," like passwords and corporate network credentials, which can lead to deeper compromise.

Their findings were shared with Microsoft, Apple, and Intel prior to release. According to the researchers, only a smattering of devices aren’t affected by the attack. Microsoft said in a recently updated article on BitLocker countermeasures that using a startup PIN can mitigate cold boot attacks, but Windows users with “Home” licenses are out of luck. And, any Apple Mac equipped with a T2 chip are not affected, but a firmware password would still improve protection.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Unlocking the Possibilities

    Security needs continue to evolve and end users are under pressure to address emerging risks and safety concerns. For many, that focus starts with upgrading perimeter openings and layering technologies—beginning at the door. Read Now

  • Freedom of Choice

    In today's security landscape, we are witnessing a fundamental transformation in how organizations manage digital evidence. Law enforcement agencies, campus security teams, and large facility operators face increasingly complex challenges with expanding video data, tightening budget constraints and inflexible systems that limit innovation. Read Now

  • Accelerating a Pathway

    There is a new trend touting the transformational qualities of AI’s ability to deliver actionable data and predictive analysis that in many instances, seems to be a bit of an overpromise. The reality is that very few solutions in the cyber-physical security (CPS) space live up to this high expectation with the one exception being the new generation of Physical Identity and Access Management (PIAM) software – herein recategorized as PIAM+. Read Now

  • Protecting Your Zones

    It is game day. You can feel the crowd’s energy. In the parking lot. At the gate. In the stadium. On the concourse. Fans are eager to party. Food and merchandise vendors ready themselves for the rush. Read Now

  • Street Smarts

    The ongoing acceptance of AI and advanced data analytics has allowed surveillance camera technology to shift from being a tactical tool to a strategic business solution. Combining traditional surveillance technology with AI-based data-driven insights can streamline transportation systems, enhance traffic management, improve situational awareness, optimize resource allocation and streamline emergency response procedures. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.