top | item 42413218

Research of RAM data remanence times

35 points| mkopec | 1 year ago |blog.3mdeb.com

6 comments

order

westurner|1 year ago

From https://blog.3mdeb.com/2024/2024-12-13-ram-data-decay-resear... :

> The main goal is to determine the time required after powering off the platform for all the data to be irrecoverably lost from RAM.

Cold boot attack: https://en.wikipedia.org/wiki/Cold_boot_attack

Data remnance: https://en.wikipedia.org/wiki/Data_remanence

Ironically, quantum computers have the opposite problem; coherence times for QC qubits are still less than a second: there is not yet a way to store qubits for even one second.

(2024: 291±6µs, 2022: 20µs)

"Cryogenically frozen RAM bypasses all disk encryption methods" (2008) https://www.zdnet.com/article/cryogenically-frozen-ram-bypas...

And that's part of why secure enclaves and TPM.

westurner|1 year ago

From https://news.ycombinator.com/item?id=37099515 :

> If quantum information is never destroyed – and classical information is quantum information without the complex term i – perhaps our [RAM] states are already preserved in the universe; like reflections in water droplets in the quantum foam

According to the "Air gap malware" Wikipedia article's description of GSMem, the x86 RAM bus can be used as a low power 3G antenna. And, HDMI is an antenna, and, Ungrounded computers leak emanations to the ungrounded microphone port on the soundcard.

Air gap malware: https://en.wikipedia.org/wiki/Air-gap_malware

Stochastic forensics: https://en.wikipedia.org/wiki/Stochastic_forensics

drpixie|1 year ago

What's with giving error rates as a count of bits, when it's not clear how much DRAM was tested? There's a comment that the error was around 50% but the graphs should be error percentage, not some (meaningless) absolute number!

And there was an interesting feature - error rates didn't seem to change linearly with time, but (strongly for DDR4 and less so for DDR5) the error rate changes in intervals of 8 seconds. That's very much unexpected, so needs a good explanation or indicates a likely error in their procedure.

Almondsetat|1 year ago

I agree that absolute numbers are a bit strange, but the article states exactly which model of memory was used, namely a W-NM56S508G SODIMM for DDR5 and a KF432C16BB/4 DIMM for DDR4, not to mention the most important part is measuring their different performance between generations

JoachimSchipper|1 year ago

The error rate is given per bit, not per second, i.e. every few bars represents a distinct DRAM chip. That makes some sense, and the article explains quite well why DRAM would behave like that... but I agree that I had to read the article at least twice to figure out that the x-axis on the graph represents the lower bit of the address line!

Still, it's nice to have at least some modern data; https://www.usenix.org/legacy/event/sec08/tech/full_papers/h... is awesome and has much more extensive measurements, but machines from 2007 are somewhat less relevant today.