Technology

Most modern computers, even devices with disk encryption, are vulnerable to a new attack that can steal sensitive data in a matter of minutes, new research says.

In new findings published Wednesday, F-Secure said that none of the existing firmware security measures in every laptop it tested &does a good enough job& of preventing data theft.

F-Secure principal security consultant Olle Segerdahl told TechCrunch that the vulnerabilities put &nearly all& laptops and desktops — both Windows and Mac users — at risk.

The new exploit is built on the foundations of a traditional cold boot attack, which hackers have long used to steal data from a shut-down computer. Modern computersoverwrite their memorywhen a device is powered down to scramble the data from being read. But Segerdahl and his colleague Pasi Saarinen found a way to disable the overwriting process, making a cold boot attack possible again.

&It takes some extra steps,& said Segerdahl, but the flaw is &easy to exploit.& So much so, he said, that it would &very much surprise& him if this technique isn&t already known by some hacker groups.

&We are convinced that anybody tasked with stealing data off laptops would have already come to the same conclusions as us,& he said.

Itno secret that if you have physical access to a computer, the chances of someone stealing your data is usually greater. Thatwhy so many use disk encryption — like BitLocker for Windows and FileVault for Macs — to scramble and protect data when a device is turned off.

But the researchers found that in nearly all cases they can still steal data protected by BitLocker and FileVault regardless.

After the researchers figured out how the memory overwriting process works, they said it took just a few hours to build a proof-of-concept tool that prevented the firmware from clearing secrets from memory. From there, the researchers scanned for disk encryption keys, which, when obtained, could be used to mount the protected volume.

Itnot just disk encryption keys at risk, Segerdahl said. A successful attacker can steal &anything that happens to be in memory,& like passwords and corporate network credentials, which can lead to a deeper compromise.

Their findings were shared with Microsoft, Apple, and Intel prior to release. According to the researchers, only a smattering of devices aren&t affected by the attack. Microsoft said in a recently updated articleon BitLocker countermeasures that using a startup PIN can mitigate cold boot attacks, but Windows users with &Home& licenses are out of luck. And, any Apple Mac equipped with a T2 chip are not affected, but a firmware password would still improve protection.

Both Microsoft and Apple downplayed the risk.

Acknowledging that an attacker needs physical access to a device, Microsoft said it encourages customers to &practice good security habits, including preventing unauthorized physical access to their device.& Apple said it was looking into measures to protect Macs that don&t come with the T2 chip.

When reached, Intel would not to comment on the record.

In any case, the researchers say, therenot much hope that affected computer makers can fix their fleet of existing devices.

&Unfortunately, there is nothing Microsoft can do, since we are using flaws in PC hardware vendors& firmware,& said Segerdahl. &Intel can only do so much, their position in the ecosystem is providing a reference platform for the vendors to extend and build their new models on.&

Companies, and users, are &on their own,& said Segerdahl.

&Planning for these events is a better practice than assuming devices cannot be physically compromised by hackers because thatobviously not the case,& he said.

Nvidia today announced its new GPU for machine learning and inferencing in the data center. The new Tesla T4 GPUs (where the ‘T& stands for Nvidianew Turing architecture) are the successors to the current batch of P4 GPUs that virtually every major cloud computing provider now offers. Google, Nvidia said, will be among the first to bring the new T4 GPUs to its Cloud Platform.

Nvidia argues that the T4s are significantly faster than the P4s. For language inferencing, for example, the T4 is 34 times faster than using a CPU and more than 3.5 times faster than the P4. Peak performance for the P4 is 260 TOPSfor 4-bit integer operations and 65 TOPS for floating point operations.The T4 sits on a standard low-profile 75 watt PCI-e card.

Whatmost important, though, is that Nvidia designed these chips specifically for AI inferencing. &What makes Tesla T4 such an efficient GPU for inferencing is the new Turing tensor core,& said Ian Buck, NvidiaVP and GM of its Tesla data center business.&[Nvidia CEO] Jensen [Huang] already talked about the Tensor core and what it can do for gaming and rendering and for AI, but for inferencing — thatwhat itdesigned for.& In total, the chip features 320 Turing Tensor cores and 2,560 CUDA cores.

In addition to the new chip, Nvidia is also launching a refresh of its TensorRT softwarefor optimizing deep learning models. This new version also includes the TensorRT inference server, a fully containerized microservice for data center inferencing that plugs seamlessly into an existing Kubernetes infrastructure.

Microsoft is pretty much done with the Windows 10 October 2018 Update – save for some minor tinkering – but work continues apace on the following update, due in the first half of next year, with a fresh preview build emerging that brings the Fluent Design interface to the operating system’s sign-in screen.

To be specific, build 18237, which has