4 ms·

well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted. not saying your idea is bad advice but

by zython 9y ago

well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted. not saying your idea is bad advice but you need the full picture to counter ransomware attacks

runeks 9y ago
Ironically, /dev/mem has been disabled to counter malware, otherwise you could do dd if=/dev/mem of=~/mem.img to obtain an image dump which may contain the decryption key.
- dTal 9y ago
  You could kexec a new kernel that didn't have that restriction.