Encryption not as full proof as you would think...

http://news.bbc.co.uk/1/hi/technology/7275407.stm

So, if I were you guys I would make sure you laptop is fully turned off for more than 10 minutes before you go in to any situation where it could be stolen.

full proof? :D

Fool proof, you mean. :p

Doesn't bother me. I don't think anyone is going to want to steal my laptop and cool it to -50C to look at me data, and if I lost it it would probably be on a train or in a cafe or something. How would they have the tools to do it within 10 minutes?

But yes it's worrying for "top secret" government info and things where spies/terrorists/whatever might try to steal it.

Though if you like in the UK you will know the government has a habit of leaving unencrypted data on disks lying around on the pavement nowadays.

lol! Yeah. Dyslexia for cure found... :)

> Dyslexia for cure found... :)

Need one for grammar too. :)

The weekest link in computer security is always the human

Yeah... I've cought the Red Oktober bug though... ... ...



The weekest link is also the Hardware. What was once thought to be volatile memory where no data survives when powered down is not so true now.

Think about all the laptops stolen including the ones in the news where sensative data is stored encrypted. Now there's ways to retreive the data without trying to break the Encryption.

all you have to do is overwrite the memory address where the encryption code is in if the computer detects idleness or powerdown.

What you going to do as a criminal wanting to get some data?

A) Somehow manage to take the computer away from the user who has happened to have already typed in the code within the last 30 seconds, then rush to a hightech lab with (probably) an electron microscrope, or some kind of high tech ram anyliser that you build with your phd knowledge and study the ram...all within a couple of mins

B) Wait till he types in the password then stab him and take the data off unlocked

C) Threaten him with a knife, make him give you the password, then stab him

D) Install a keylogger (stabbing optional)

the correct answer is all apart from A)

Threaten a laptop with a knife and its just as secure, treaten a guy who just wants to go home to his family after 5pm and you have anything you want (unless he is a ninja, and you din't want a world of pain). (A kife is a lot cheaper than 6 years of Uni and an electron microscope)

dont give spies and government officials fin laptops
nor letters to post

anyone stupid enough to leave such sensitive information in a tapas bar after getting wankered shouldnt have taken it there in the firsst place
so said offender should be taken to a far off corner of the world put up against the wall and shot
then a phot of his / her corpse emailed to all operatives as a warning

Q "ah mr bond here is your new laptop, shouuld you loose it this explosive device inserted next to your heart will explode ... now dont be so fin careless next time"

This is just one of those classic 'we are all screwed' news reporting becuase its more dramatic, and news has to be XTREME (without the leading e) these days.

What happened to? bird flu/CJD/Meteors/Y2K Killllllerrrr/The British/Witches? More people probably die in the bath in 1 month, than all those put together throughout the history of the human race (excluding the british one, we do like killing people, especially if they use encryption on their laptops).

Lots of stabbing there boomboom ^_^ hehe.

weakest

This is great news. It makes it much easier to spot corporate spies and laptop thieves. They're the ones carrying around the 140 gallon container of liquid nitrogen so they can keep your computer at -50 until they can hack the encryption.

Like anything else, if a 10000 men can make it, 1 man can break it. Some clever sod will beat whatever protection system they put in his/her way eventually, with no liquid nitrogen required! :)

BBC tech news digs out lots of pointless 'tech' stories, if you watch carefully, it usually takes them days to update the technology front page, even with one new article so sometimes, they'll snatch anything to keep it 'fresh'(ish).

Thats a bit OTT to be honest. Its true that they can dump the memory in those few minutes before it dies, by killing the power to a sleeping laptop and then booting up immediately with a special dump tool. (Which could then be used to extract the key)
I work contract IT support for a biotech firm who have extremely strict data controls and their IT security mob have known about this for a while. They have disabled both hibernate and suspend via user-policy controls on all encrypted laptops. Plus they have bios protection enabled to prevent boot from other devices, which while easily hackable, probably takes more than the few minutes they have got before the ram looses integrity.

English- not as fool proof as you'd think.

Not exactly news...

When I turned my C64 off and then turned it on again quickly(on the wall switch), it would boot to prompt(CBM BASIC V2), but sometimes retain parts of the previous memory content, as was evidenced by peeking into memory.

i remember being told that amgia virus' could stay memory resident and had to be switched off for 20+ seconds to ensure a clean boot

dunno if their is a reset to zero bit of code that wipes all ram like a disc format does (although untill its rewritten that is recoverable too) i do remember (but not the exact code) 2 16byte exe's you could make with a hex editor
one would be a ctrl-alt-del reboot and the other more of a hardware reset dont know if either would have retained any ram info though

hey... you can do it much easier


is is possible to use firewire to get full RAM-access. Because firewire has DMA by design.

give bond and the likes rice paper with instructions written in lemon juice
thatll teach the bastards to leave expensive and cheap laptops lying around begging to be stolen or left outside a tabloid journalists doorstop

better still threaten mr. winkie on boot up

"should you loose this laptop you will loose mr. winkie" click ok to continue

most dangerouse eula going?