7

For mysterious reasons I still double boot sometimes into Windows.

My problem is that I fear that information may leak because the RAM memory is accessible to Windows. (the Linux partitions are encrypted and the bootmedia is not inserted, though).

Is there a way to setup (in a recent kernel and GNU/Linux based system) a way to have the kernel wipe the memory at shutdown?

Also since LUKS plays an important role, does it wipe its memory at shutdown to avoid leakage and also "cold boot attack"?

Improve this question
3
  • @StephaneChazelas thanks for the note on tails. I have looked into it. Maybe I do not completetly understand but it seems they mainly used userspace tools to allocate RAM. What about the potentially more risky parts of the RAM the kernel uses? Even more so the part of the Kernel dealing with LUKS/encryption and keys...? – humanityANDpeace Apr 1 '14 at 10:53
  • 1
    If I understand correctly, it kexecs a kernel upon shutdown that writes all memory. tails.boum.org/contribute/design/memory_erasure is probably a better link. – Stéphane Chazelas Apr 1 '14 at 11:36
  • @StephaneChazelas Thank you again! took me some time to comprehend your hint/comment. I was not very familiar with the kexec command. The idea anyways seems smart, the replacement kernel might be very small, as all it needs to do is to wipe the RAM. Being small it blocks/exempts itself much RAM from being wiped. Do you want to expand the comment to an answer I can accept? – humanityANDpeace Apr 1 '14 at 13:43
5

Enable the "check memory on boot" option in your BIOS, which will go through and write then read to all of the memory in order to check that it's working, clearing it at the same time.

If you're also concerned about the cold boot issue, stand by your computer for the five minutes or so it takes for a cold boot attack to no longer be of any use, and stab anyone who approaches the machine with a can of freeze spray. Or just install a decent lock on your server room / basement door to keep people from physically getting to your machine (where they'll probably just steal the hard drive anyway) to begin with. :)

Improve this answer
1
  • 1
    I'm guessing this is about delicate browser history of ingognito tabs that may never leak. They can have the HDD contains less critical information :-) – Bananguin Sep 14 '18 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.