In a move that harkens back to the days of the enigma machine, German researchers near the Bavarian city of Nurmeberg have made another revelation in the world of cryptography, this time cracking the so-called secure device you (likely) carry in your pocket.  The results of the study are still yet to be published, but it appears that all Andriod devices are prone to what’s called a cold boot attack.

What is a cold boot attack?

Just as you can see a light bulb’s element glow and subsequently dim after turning out the light, your phone’s electronics undergo the very same phenomenon once you power down your device.  The only difference is, those electronics in your phone are made to radiate heat very well, and as such, the electrons succumb to entropy and you lose all their charge very quickly.

So say you’re a hacker and you have a target’s phone.  You want to be able to get the phone’s data, it’s turned on, but you can’t get past the code screen.  You could interrupt the power to the phone, and just like the light bulb  read the entire memory contents with a device/computer just from the faint afterglow left after powering down.

Here’s where the trick comes in:

Since phones don’t tend to maintain their “afterglow” very long, it’s necessary to counter entropy in order to keep the electrons on the Android’s RAM less excited.  The most convenient and effective way to do this is by cooling the device in the freezer, and the colder you can get it, the longer you have to read it.

One can see that this is clearly an issue with hardware security, and not something you can immediately patch for, but John Casaretto’s take was that we probably have nothing to fear from this issue;”There’s a significant threat, but at this point there isn’t much really to be concerned about.”  Casaretto later clarified, “There’s no easy way to defend this attack,” but his prognosis was that this sort of hack is nothing to be too incredibly worried about, simply given the lack of practicality of the exploit, and the requirement for certain circumstances, such as the phone being recently powered down.

With this news and other news involving Google Play’s relatively open policies with user data to app makers, there’s some concern over the Android’s overall privacy levels, especially considering the cold boot attack issue doesn’t seem to affect either Apple, or Windows devices.  Later on, we asked John about how he thought this news would impact the sales for the competitors, including the up and coming Blackberry Z10.

John’s outlook on this issue seemed rather grim for Google; “In terms of the corporate market…they’re already dealing with that…and people may start looking at android as an insecure platform altogether…People are going to be looking at some alternatives, at least from the enterprise perspective.”

See the entire segment with Kristin Feledy and John Casaretto on the Morning NewsDesk Show.

photo credit: St Stev via photopin cc