Frozen Android phones give up data secrets

bbc.co.uk

11 points·iProject··5 comments

This really has nothing to do with Android, or even phones. It's a well-known exploit that works against most devices.

And the defense is well-known too right?

Yes, don't get your device in the hands of attackers.

And keep your bootloader locked. It's nice that you can do this on many devices but you probably shouldn't if you care enough to encrypt your data.

They used fastboot mode to boot a custom recovery image to perform the cold boot attack. I imagine it would have to be much more difficult if you couldn't boot unsigned code.

At least on Nexus devices unlocking the bootloader results in a data wipe, in an attempt to mitigate some of this risk. Otherwise someone can just take your phone from you, unlock the bootloader, and do who knows what to it.

Similarly, don't leave USB debugging mode on when you're not using the device; with that on you can extract tons of data whether the phone is encrypted or not (since the user data volume is decrypted when it's mounted at boot time). USB debugging is how many of the Cellebrite and other forensic extractors work: http://www.cellebrite.com/forensic-solutions/android-forensi...

They've done some work to address this in Android 4.2.2, where now there's a key exchange taking place as part of the debug mode handshake and you're prompted on the device to accept the signature. If the device is locked then the attacker wouldn't be able to answer the prompt.

It was not well known (before this came out last month) that putting an unlocked Android phone in the freezer lets you pull off a practical cold boot attack for the flash crypto keys.

Here's previous discussion: http://news.ycombinator.com/item?id=5231454

Reply on news.ycombinator.com