Security Flaw Discovered in Nearly All Macs and PCs

Security Flaw Discovered in Nearly All Macs and PCs

A new vulnerability brings back the risk of a cold boot attack.

In new findings published last week, F-Secure said that no modern device, Macs and PCs alike, do not have existing firmware security measures that "do a good enough job" preventing a new attack that can steal sensitive data in a matter of minutes.

F-Secure principal security consultant Olle Segerdahl explained that the vulnerabilities put "nearly all" laptops and desktops at risk.

The new exploit is built on the foundations of a traditional cold boot attack, a technique that is well known in the hacking community. Modern computers overwrite their memory when a device is powered down to scramble the data from being read. F-Secure believes they have found a way to disable the overwriting process, making a cold boot attack possible again.

"It takes some extra steps," Segerdahl said. "But the flaw is easy to exploit."

So much so, that it would "very much surprise" him if this technique isn't already known by some hacker groups.

It is no secret that if you have physical access to a computer, the changes of someone stealing your data is usually greater. That's why so many use disk encryption, like BitLocker for Windows and FileVault for Macs, to scramble and protect data when a device is turned off. The researchers, however, found that in nearly all cases, they can still steal data protected by those programs.

After the researchers figured out how the memory overwriting process works, they said it took just a few hours to build  a proof-of-concept tool that prevented the firmware from clearing secrets from memory. From there, the researchers scanned for disk encryption keys, which, when obtained, could be used to mount the protected volume.

It's not just disk encryption keys at risk, Segerdahl said. A successful attacker can steal "anything that happens to be in the memory," like passwords and corporate network credentials, which can lead to deeper compromise.

Their findings were shared with Microsoft, Apple, and Intel prior to release. According to the researchers, only a smattering of devices aren’t affected by the attack. Microsoft said in a recently updated article on BitLocker countermeasures that using a startup PIN can mitigate cold boot attacks, but Windows users with “Home” licenses are out of luck. And, any Apple Mac equipped with a T2 chip are not affected, but a firmware password would still improve protection.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • The Yellow Brick Road

    The road to and throughout Wednesday's and Thursday's ISC West was crowded but it was amazing. Read Now

    • Industry Events
    • ISC West
  • An Inside Look From Napco at ISC West

    Get a look into the excitement at ISC West 2025 from Napco. Hear from some of their top-tech executives live from the show floor. Read Now

    • Industry Events
    • ISC West
  • Upping the Ante

    I am not a betting man in terms of cards, dice, blackjack or that wheel with the black marble racing around the circumference of a spinning wheel, but I would bet on the success of ISC West this year. Read Now

    • Industry Events
    • ISC West
  • It's Show Time

    I am one of those people that likes to see things get bigger and better. As advertised, ISC West is going to be bigger (more exhibitors) and better (more attendees). It’s show time in Las Vegas. Read Now

    • Industry Events
    • ISC West

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.