Hackers could restart a cold boot attack to steal sensitive data from your modern PC

A vulnerability on most modern PCs and Macs could leave your data exposed. F-Secure's cybersecurity researchers found that the weakness of the most modern computer firmware could allow hackers to access encryption keys and other sensitive data.

Access to sensitive data is achieved through a 2008 type cold attack, where the hacker forces a computer to reboot without going through the normal shutdown process. Computer data is briefly accessible in RAM after power is turned off, but many modern devices overwrite RAM to prevent unauthorized access to data during this type of attack. The researchers discovered that there is a way to disable the crash process, essentially reliving the ten-year-old attack method.

"The attack exploits the fact that the firmware settings governing the behavior of the boot process are not protected against manipulation by a physical attacker," wrote F-Secure in a blog post. "By using a simple hardware tool, an attacker can rewrite the non-volatile memory chip that contains these settings, disable memory replacement, and enable booting from external devices. The cold attack can be performed by starting a special program on a USB stick.

Despite the seriousness of the results, the vulnerability may not be so prejudicial as to carry out this exploit, hackers would need physical access to your device. If a hacker has physical access, the exploit can be executed in about five minutes, warned the researchers.

F-Secure shared its findings with Microsoft, Apple, and Intel, but since this type of attack requires physical access to the device, it does not appear that a fix is ​​forthcoming. New Mac systems with a T2 chip are not affected by this attack, and Microsoft says that pre-boot authentication with a PIN or a startup key with BitLocker could help mitigate these risks. These advanced security tactics are not available to consumers who use Windows 10 Home Edition.

"Unfortunately, Microsoft can not do anything because we are using flaws in PC hardware vendor firmware," TechCrunch Olle Segerdahl, Senior Security Consultant at F-Secure, told TechCrunch. "Intel can only do a lot, their position in the ecosystem provides a reference platform for suppliers to extend and develop their new models."