Hacker News new | ask | show | jobs
by Retr0id 28 days ago
The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!
2 comments
dlcarrier 28 days ago
Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
link
alfiedotwtf 28 days ago
Wow, that sounds quite slow? I wonder what speed boosts you could get if you disable this if this is not an attack vector you want to cover
link
dlcarrier 28 days ago
It's done transparently in hardware, so it doesn't slow down the RAM.
link
Retr0id 27 days ago
It usually has a latency cost, but it's not much.
link
Retr0id 27 days ago
If you have 256GB/s of memory bandwidth and 64GB of RAM, you can zero it all in 250ms.
link
liffik 28 days ago
Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part.

To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up.

Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here:

Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times.

Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact.

P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!

link