The Meltdown and Spectre vulnerabilities rocked the entire PC industry, and despite several patches to mitigate the risks, new variants of the flaws continue to surface. And it seems there is no respite for security professionals.
Finnish cybersecurity company, F-Secure, has discovered a new firmware flaw which affects all modern laptops and can be exploited to steal encryption keys and sensitive data.
The vulnerability allows a malicious party to perform a cold boot attack on a device which they can physically access, and all it takes is just 5 minutes to get past the security layers of a Windows or macOS-powered laptop and steal sensitive information.
“It takes some extra steps compared to the classic cold boot attack, but it’s effective against all the modern laptops we’ve tested”, said F-Secure Principal Security Consultant, Olle Segerdahl. Modern laptops come with a safety mechanism to thwart cold boot attacks, but F-Secure’s team discovered a flaw in that mechanism which allows hackers to disable the security firewall and successfully execute a cold boot attack.
“Because this attack works against the kind of laptops used by companies there’s no reliable way for organizations to know their data is safe if a computer goes missing. And since 99 percent of company laptops will contain things like access credentials for corporate networks, it gives attackers a consistent, reliable way to compromise corporate targets”, Segerdahl explained.
But the most worrisome aspect of the new discovery is that the vulnerability cannot be fixed easily, and as per F-Secure, companies should brace themselves for such attacks. The only way theft of sensitive data can be prevented is by configuring all laptops to automatically shut down or go into hibernation mode whenever a device boots or restores.
Moreover, log-in credentials for accessing a network should immediately be changed as soon as a device is reported missing, because once a malicious party has got physical access to a computer, they have ample amount of time to exploit the firmware flaw and perform a cold boot attack to steal information. F-Secure has already shared details of the new vulnerability with Intel, Microsoft, and Apple to alert them about the threat.
