4 ms·
It depends on how the server was hosted. If it was on a cloud, the provider could have suspended the vm and slurped the encryption key directly from memory. Ba
by _nhynes 7y ago
It depends on how the server was hosted. If it was on a cloud, the provider could have suspended the vm and slurped the encryption key directly from memory.
Bare metal would have been a bit harder, but still possible by probing the memory bus.
One could counter this by storing the disk encryption key in a hardware enclave (e.g., SGX).
- mox1 7y agoOr you know, just copy the entire drive while the machine is running....
- milankragujevic 7y agoThat would not help you, since the contents on the disk are encrypted. You need to get the key from RAM while the server is turned on AND mirror the disk. Doing just the mirror will not help you.
- mox1 7y agoThe copy uses the OS's system calls to transfer data. Thus it will definitely decrypt. If the OS can function, it can read the decrypted data. An Linux OS with full disk encryption can easily be copied while running as root with a simple rsync. Same with Windows.
- milankragujevic 7y agoYes, but you need access to the OS, which means you need a login exploit AND privilege escalation exploit, or a hardware-based backdoor or to mess with the RAM bus while the computer is on.