Erase memory on shutdown

[Valeri Galtsev]

On Sun, August 5, 2018 9:36 pm, Erich Dollansky wrote:
> Hi,
>
> On Sun, 5 Aug 2018 19:10:07 -0500 (CDT)
> "Valeri Galtsev" <galtsev at kicp.uchicago.edu> wrote:
>
>> On Sun, August 5, 2018 6:37 pm, Erich Dollansky wrote:
>> > Hi,
>> >
>> > On Sun, 5 Aug 2018 10:55:22 -0500 (CDT)
>> > "Valeri Galtsev" <galtsev at kicp.uchicago.edu> wrote:
>> >
>> >> On Sun, August 5, 2018 10:26 am, thor wrote:
>> >> > https://en.wikipedia.org/wiki/Cold_boot_attack
>> >> >
>> >>
>> >> The trouble is that erasing RAM on clean shutdown does not prevent
>> >> the attacker in the attack as above from still successfully
>> >> perform the
>> >
>> > so, ECC is also here the only possible answer, at least for parts
>> > of it.
>> >
>> > Still, erasing memory when shutting down helps in some cases. I do
>> > this on my machines for small parts when a shutdown is detected. It
>> > makes at least the most obvious attacks from that side difficult.
>>
>> Please, correct me if I am wrong in the following:
>>
>> If the attacker yanks off the power cord, then cold boots off his
>> media, your defense/erasure of memory does not protect you against
>> this attack. Right? Your defense only helps if the attacker does
>> clean shutdown. Right?
>>
> what is the difference between 'some cases' and 'all cases'?
>
> If the owner of a machine is not able to stop physical access to a
> machine, there will be other ways to attack it. Shutting down a machine
> allows a normal owner of the machine to wait at the location as most
> owners are not on the run.

I do understand every word, but I'm not certain I quite follow what you
are saying.

On the other hand, I have a feeling that we all are on the same page about
physical security. Other nuances of what we do on our machines may be
different, and probably will stay without change for each of us. This
might be the case when participants of the discussion don't learn any
wisdom from each other, and there is nothing wrong about it.

Thanks.

Valeri

>
> Erich



++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++