Congelan un móvil para acceder a su contenido cifrado

En BBC News, Frozen Android phones give up data secrets, Investigadores de la universidad alemana Friedrich-Alexander pusieron un teléfono Android, un Google Nexus de Samsung, en un congelador durante una hora hasta que el móvil alcanzó una temperatura de 10 grados bajo cero.

Después quitaron y pusieron de nuevo la batería del teléfono congelado, lo que dejó el móvil en un modo vulnerable. Ese momento les permitió iniciar el teléfono con un software para Linux desarrollado por los investigadores [apropiadamente] llamado Frost, Forensic Recovery of Scrambled Telephones (recuperación forense de teléfonos cifrados) con el que pudieron copiar datos contenidos en el teléfono [protegidos con el mecanismo de cifrado de Android 4.0 y superiores] y transferirlos al ordenador.

No está claro hasta qué punto es necesario congelar el teléfono —al parecer el frío hace que la RAM retenga datos clave antes del reinicio—, pero desde luego el método da una nueva dimensión al significado de ataque por arranque en frío.

1) We provide a pre-compiled, easy-to-use recovery image to deploy cold boot attacks against Samsung Galaxy Nexus devices. If you own another device, you can use our system tools given in the download section to build your own recovery image.	2) Let's assume you got physical access to a device that is scrambled (with Android 4.0) and locked. And that you want to gain access to its data but don't know the PIN.	3) First assure the phone has enough power for the next hour. If not, please charge it. Otherwise pack it into a freezer bag.
4) Then put the phone into a freezer. Cooling the device down under 10 degree Celsius increases the success of cold boot attacks considerably, because RAM contents fade away more slowly if RAM chips are cold.	5) Let the phone inside a -15 degree Celsius freezer for about 60 minutes. Btw, we do not provide guarantee. Damaging the phone is your own risk, but we haven't experienced any problems yet.	6) After an hour, the phone temperature should be below 10 degree. Note that the temperature varies with the point you measure (metal or plastic). Usually we measure a point of the phone's motherboard (below the SIM card slot).
7) If the phone is cold enough, quickly check if it is still working by pressing the power button. If so, we are now ready to deploy cold boot attacks against it.	Unfortunately, the Galaxy Nexus has no 'reset-button' and shutting the device down in software is too slow.	9) So we must to reboot the device by replugging its battery quickly. To this end, remove the battery cover.
10) Raise the battery slowly, without disconnecting it from the phone, until it is a bit above the device case.	11) Then push the battery back and forth very quickly, such that it gets disconnected from the phone for less than 500ms.	12) Immediately afterwards (or better already before) hold the power button together with the volume up and volume down buttons.
13) This key combination brings you into 'fastboot' mode, rather than booting into Android. In fastboot mode, we can flash our FROST recovery image onto the device.	14) To this end, connect the smartphone to a Linux PC via USB. On the Linux PC, the fastboot utilities must be installed.	15) Flash the frost.img file from our download section to the phone: 'fastboot flash recovery frost.img'. For this command to work, the bootloader must be unlocked.
16) After the flash operation has finished, you can choose the 'Recovery Mode' option from the fastboot menu.	17) Now the phone boots into FROST, without the requirement to reboot it again (which is important in the cold boot scenario).	18) Inside the recovery image, we suggest to try the recovery of FDE keys from RAM via quick search mode. If that fails, you can try full search, or the bruteforce approach. On success you can decrypt the user partition now.