5 ms·

Physical server can also be frozen (literally) and then data extracted from RAM.

LinuxBender 3y ago
It can but to my knowledge law enforcement in the US anyway have only done this once for a national security incident in the real world outside of a lab. If you have any links to this becoming common practice outside of a lab demo or security presentation on their own hardware I would be interested to save in my own documentation. They can also buy cases that have anti-tampering controls that force a poweroff if the case is opened but that is getting into more costly edge cases. The hardware exists but is not datacenter operations friendly. It is also possible to force a wipe of ram on a clean shutdown but one must assume this won't be. As one example the feds took Mega's servers from Equinix after yanking out the cables and out the door they went. [Edit] I should add for completeness sake there are kernel boot options to clear memory space before allocation and after de-allocation with a performance hit. Both are enabled by default on modern kernels now. init_on_alloc=1 init_on_free=1
- mschuster91 3y ago
  There exist special UPSes that you can attach to a power line of a server, unplug and unmount it, and keep the server powered all the time, without the server being able to detect that. If you are really serious about security, you need to have a watchdog on network link downtimes because, no matter what, you can't disrupt a fiber optic network link without the server noticing.
  - tln 3y ago
    Whoa! Any keyword suggestions to find those UPSes?
    - Eldt 3y ago
      I'm having trouble remembering what they're called, but I do remember reading about these. I saw a demonstration where they slightly pulled at the desktop power plug in order to hook a thin device around the plug connectors to provide power, and then they could transport the desktop around.
      - kl4m 3y ago
        It becomes way more straightforward if it's a server with redundant power supplies.
        tuetuopay 3y ago
        Actually not because a server with multiple PSUs definitely knows when one loses power. It’s made to raise alerts about a power rail failing. So this makes it harder because you need to keep power on both to not raise any alarm
      - rwmj 3y ago
        For laptops, law enforcement use "mouse jigglers" to prevent screen locks and laptops going to sleep, which I guess is similar. Random article: https://www.electronicproducts.com/what-is-a-mouse-jiggler-and-why-does-the-fbi-use-it-when-seizing-computers/ https://www.electronicproducts.com/what-is-a-mouse-jiggler-a...
    - fmajid 3y ago
      https://wiebetech.com/products/hotplug-field-kit/ https://wiebetech.com/products/hotplug-field-kit/
    - deleted 3y ago
      [deleted]
  - 0cf8612b2e1e 3y ago
    Just like Seinfeld and saving the Frogger high score.
- deleted 3y ago
  [deleted]
greentea23 3y ago
Are there any known examples of this actually being done by law enforcement or government and working?
- ziddoap 3y ago
  There are plenty of examples of it working (e.g. researchers from F-Secure presented at SEC-T conference in 2018 with a cold-boot against Bitlocker), but I haven't seen a LEA or government come out and say "we got access to X via a cold-boot attack".
  - 0cf8612b2e1e 3y ago
    As RAM densities/speed increase, I wonder if this is still viable. DDR5 had to mandate some baseline ECC given the intrinsic error rate.
  - roenxi 3y ago
    Although, obviously, it was the same story with dragnet spying before Snowden. Sure it was technically possible in a lab environment and law enforcement had incentive to do it, but nobody could turn up any actual evidence.
adrian_b 3y ago
That is why modern servers have the option to encrypt the DRAM to prevent this attack. Moreover, there is also the option to have distinct randomly-generated keys for each virtual machine, to make useless the speculative attacks that succeed to peek at the memory of another VM. AMD has offered these options for years and the future Intel CPUs will also have them.
xyst 3y ago
good ole can of air compressor flipped upside down and quick hands trick

It can but to my knowledge law enforcement in the US anyway have only done this once for a national security incident in the real world outside of a lab. If you have any links to this becoming common practice outside of a lab demo or security presentation on their own hardware I would be interested to save in my own documentation. They can also buy cases that have anti-tampering controls that force a poweroff if the case is opened but that is getting into more costly edge cases. The hardware exists but is not datacenter operations friendly. It is also possible to force a wipe of ram on a clean shutdown but one must assume this won't be. As one example the feds took Mega's servers from Equinix after yanking out the cables and out the door they went. [Edit] I should add for completeness sake there are kernel boot options to clear memory space before allocation and after de-allocation with a performance hit. Both are enabled by default on modern kernels now. init_on_alloc=1 init_on_free=1

mschuster91 3y ago
There exist special UPSes that you can attach to a power line of a server, unplug and unmount it, and keep the server powered all the time, without the server being able to detect that. If you are really serious about security, you need to have a watchdog on network link downtimes because, no matter what, you can't disrupt a fiber optic network link without the server noticing.
- tln 3y ago
  Whoa! Any keyword suggestions to find those UPSes?
  - Eldt 3y ago
    I'm having trouble remembering what they're called, but I do remember reading about these. I saw a demonstration where they slightly pulled at the desktop power plug in order to hook a thin device around the plug connectors to provide power, and then they could transport the desktop around.
    - kl4m 3y ago
      It becomes way more straightforward if it's a server with redundant power supplies.
      - tuetuopay 3y ago
        Actually not because a server with multiple PSUs definitely knows when one loses power. It’s made to raise alerts about a power rail failing. So this makes it harder because you need to keep power on both to not raise any alarm
    - rwmj 3y ago
      For laptops, law enforcement use "mouse jigglers" to prevent screen locks and laptops going to sleep, which I guess is similar. Random article: https://www.electronicproducts.com/what-is-a-mouse-jiggler-and-why-does-the-fbi-use-it-when-seizing-computers/ https://www.electronicproducts.com/what-is-a-mouse-jiggler-a...
  - fmajid 3y ago
    https://wiebetech.com/products/hotplug-field-kit/ https://wiebetech.com/products/hotplug-field-kit/
  - deleted 3y ago
    [deleted]
- 0cf8612b2e1e 3y ago
  Just like Seinfeld and saving the Frogger high score.
deleted 3y ago
[deleted]

greentea23 3y ago

Are there any known examples of this actually being done by law enforcement or government and working?

ziddoap 3y ago
There are plenty of examples of it working (e.g. researchers from F-Secure presented at SEC-T conference in 2018 with a cold-boot against Bitlocker), but I haven't seen a LEA or government come out and say "we got access to X via a cold-boot attack".
- 0cf8612b2e1e 3y ago
  As RAM densities/speed increase, I wonder if this is still viable. DDR5 had to mandate some baseline ECC given the intrinsic error rate.
- roenxi 3y ago
  Although, obviously, it was the same story with dragnet spying before Snowden. Sure it was technically possible in a lab environment and law enforcement had incentive to do it, but nobody could turn up any actual evidence.

adrian_b 3y ago

That is why modern servers have the option to encrypt the DRAM to prevent this attack. Moreover, there is also the option to have distinct randomly-generated keys for each virtual machine, to make useless the speculative attacks that succeed to peek at the memory of another VM. AMD has offered these options for years and the future Intel CPUs will also have them.

xyst 3y ago

good ole can of air compressor flipped upside down and quick hands trick