ram-wipe - Wipe RAM on shutdown and reboot

From Kicksecure
Jump to navigation Jump to search
ram-wipe logo

Wipe RAM at shutdown to prevent information extraction from memory.

ram-wipe is a software project designed to protect against RAM extraction attacks by erasing the contents of a computer's random access memory (RAM) when the system is shut down or restarted. This helps prevent attackers from recovering sensitive data that may have been temporarily stored in RAM.

ram-wipe is especially useful for organizations that work with confidential information and need an extra layer of security. By clearing the RAM during shutdown or reboot, ram-wipe reduces the risk of data theft through RAM extraction and improves overall system security.

Introduction

[edit]

RAM extraction attacks have been a known method to steal information from computers since at least 2008. [1] Many people assume that all data in RAM disappears as soon as a computer is turned off, but this isn’t always true. In some cases, the contents of RAM can remain for several seconds or even minutes after power loss.

Research by 3MDEB [2] confirms that this type of attack still works with modern RAM like DDR4 and DDR5, which are common in today’s computers. Sometimes RAM is wiped instantly after shutdown or power loss, but in many cases the contents can stay for a few seconds, or even minutes.

Since at least 2011, the Linux live operating system Tailsarchive.org iconarchive.today icon has included a RAM wiping feature during shutdown. [3] (Live systems are run from USB sticks or DVDs.) However, Tails’ documentationarchive.org iconarchive.today icon explains that this feature has limitations.

Until recently, no other Linux distributions like Debian or Fedora included RAM wiping by default.

In 2023, the ram-wipe package was released as a new solution. It wipes RAM during Linux kernel reboot or shutdown sequences, helping prevent data from being recovered later. There has also been a ram-wipe security-audit by 3MDEB in 2025archive.org iconarchive.today icon.

ram-wipe works on Debian, Kicksecure, and possibly other Linux systems. It can also be adapted for other Linux-based setups or devices.

The tool uses a dracut module, a plugin for the Dracut tool, which helps create the early environment used when the system boots. Many Linux distributions already include Dracut, so packaging ram-wipe for other systems is easier.

ram-wipe is free to use and Open Source. The source codearchive.org iconarchive.today icon is available and has minimal dependencies (which are other software that must be present for a program to work). It is also Freedom Software, meaning anyone can study, modify, and share it under its license.

However, software-based RAM wiping (like ram-wipe or the feature in Tails) has a key limitation: It only works if the system shuts down properly. For example, it will not protect from some of the cold boot attacks when the device suddenly loses power (for example when the power supply is being unplugged suddenly), and the software execution flow is broken. In such case, ram-wipe will not have a chance to be launched.

For technical details on ram-wipe using initramfs-tools (a tool for building the early boot environment, similar to Dracut), see: Status of initramfs-tools Support.

See also:

Installation of ram-wipe

[edit]

1. Platform specific notice.

  • Debian: Debian comes with initramfs-tools by default.
  • Kicksecure: Newer builds of Kicksecure come with dracut by default.
  • Qubes: Unsupported. [4]

2. Migrate to dracut. [5]

It's required to migrate to dracut if not already done. See instructions on the dracut wiki page to find out if dracut is already installed and to find instructions on how to install it.

3. Reboot.

This is to test if dracut is functional. If the system boots normally, then everything is okay.

4. Add Kicksecure APT repository.

Note: Users of Kicksecure can skip this step.

1. Download the Signing Key.

wget https://www.kicksecure.com/keys/derivative.asc

2. Optional: Check the Signing Key for better security.

3. Add Kicksecure signing key.

sudo cp derivative.asc /usr/share/keyrings/derivative.asc

4. Kicksecure APT repository choices.

Optional: See Kicksecure Packages for Debian Hosts and Kicksecure Host Enhancements instead of the next step for more secure and complex options.

5. Add Kicksecure APT repository.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

5. Install ram-wipe.

sudo apt update

sudo apt install ram-wipe

6. Done.

The process of installing ram-wipe has been completed.

Host vs VMs

[edit]

ram-wipe is useful on the host operating system but not so much inside a VM. See also Dev/RAM_Wipe#ram-wipe_Testing_inside_a_VM.

Sample Printout

[edit]

Boot Printout

[edit]
[  OK  ] Reached target initrd.target - Initrd Default Target.
         Starting dracut-pre-pivot.service - dracut pre-pivot and cleanup hook...
[    8.686156] dracut-pre-pivot[763]: INFO: wipe-ram-needshutdown.sh: Calling dracut function need_shutdown to drop back into initramfs at shutdown, OK.
[  OK  ] Finished dracut-pre-pivot.service - dracut pre-pivot and cleanup hook.

Shutdown Printout

[edit]
[   42.474323] dracut INFO: wipe-ram.sh: RAM extraction attack defense... Starting RAM wipe pass during shutdown...
[   42.501159] dracut INFO: wipe-ram.sh: RAM wipe pass completed, OK.
[   42.502837] dracut INFO: wipe-ram.sh: Checking if there are still mounted encrypted disks...
[   42.508801] dracut INFO: wipe-ram.sh: Success, there are no more mounted encrypted disks, OK.
[   42.530125] reboot: Restarting system

ram-wipe Known Issues

[edit]
  • Wiping the video RAM (the RAM of the graphics card) has not been implemented anywhere to the knowledge of the author. [6]

Unmount Encrypted Root Disk to Wipe Full Disk Encryption Key

[edit]

To wipe the LUKS full disk encryption (FDE) for the root disk from RAM it is required to unmount the root disk file system and close the root disk LUKS volume during the shutdown process.

This has been implemented as per dracut shutdown hook to close encrypted devices and wipe their encryption keys from kernel memoryarchive.org iconarchive.today icon.

ram-wipe attempts to check if unencrypted root disks have been unmounted at the end of the shutdown process and to inform the user in case of potential failures.

Status

[edit]
  • ram-wipe is installed by default in Kicksecure 18 (and above).

Development

[edit]

Footnotes

[edit]
  1. ↑ https://en.wikipedia.org/w/index.php?title=Cold_boot_attack&oldid=249088610archive.org iconarchive.today icon
  2. ↑
  3. ↑ https://web.archive.org/web/20110423165633/https://tails.boum.org/contribute/design/memory_erasure/archive.org icon
  4. ↑
  5. ↑ Since ram-wipe is unavailable for initramfs-tools the user needs to migrate to dracut, the only supported initrd creator by ram-wipe.
  6. ↑ Erase video memory on shutdownarchive.org iconarchive.today icon


Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Ram-wipe&oldid=103673"