Practical Cold boot attack on IoT device - Case study on Raspberry Pi -

Abstract

Volatile memory like SDRAM, forms an integral part of any computer system. It stores variety of data including sensitive data like passwords and PIN. The data stored in SDRAM is wiped off on power-off. However, by bringing the RAM to freezing cold temperature before power off, the data can persist for several seconds, allowing recovery through cold boot attacks. In this work, we investigate the vulnerability of IoT device such as Raspberry Pi against cold boot attack for the first time. Our study found that even though the boot sequence is different from laptop, personal computer, and smartphone, we demonstrate that it is still possible to steal the RAM data, even when the bootloader is not public. The net cost of the attack was under 10 dollars and 99.99% of the RAM data was successfully recovered.

DeepFreeze: Cold Boot Attacks and High Fidelity Model Recovery on Commercial EdgeML Device

“…Unauthorised access to SRAM data through cold boot attacks can lead to serious security breach in the target system. The practicality of cold boot attacks have been widely demonstrated on platforms like laptop [7], desktop [9], scrambled RAM [10], smartphones [11] and IoT device [12]. Depending on the temperature of the memory, the data stored in memory can potentially retain even though losing the power.…”

“…desktop and laptop), the adversary can remove the victim memory and connect to another machine for recovering the data. If the memory cannot be separated due physical constraints (like stacked memory in chip package), a vulnerable boot sequence can be exploited to recover the sensitive data from cold boot [12]. In this paper, we concentrate on the vulnerability of Raspberry Pi against cold boot attack in order to investigate the ML model recovery.…”

“…To perform the attack, we need to identify the boot sequence of Raspberry Pi. Won et al [12] showed an attack on Raspberry Pi for recovery of memory content which was image data in their use case. We use a similar approach in the following.…”

Are Cold Boot Attacks Still Feasible: A Case Study on Raspberry Pi With Stacked Memory

“…Although the devices used in IoT are low-cost, they do come in complex packaging adopting methods like stacked memory, package on package etc. Won et al [7] presented a first vulnerability investigation of modern IoT devices with stacked memory against cold boot attacks and reported high recovery rate from stacked RAM. While [7] explores the feasibility of cold boot attacks, the work is done in simple setting with no encryption enabled.…”

“…Won et al [7] presented a first vulnerability investigation of modern IoT devices with stacked memory against cold boot attacks and reported high recovery rate from stacked RAM. While [7] explores the feasibility of cold boot attacks, the work is done in simple setting with no encryption enabled. In this work, we investigate practical cold boot attacks to recover encryption keys from IoT devices.…”