3 ms·

What's the threat model that ram interception is an issue? I think the upsell is entirely reasonable, you get charged more for weird compliance demands.

• candiddevmike 2y ago
  What's a threat model where RAM intercept wouldn't be an issue?
  • udev4096 2y ago
    Isn't it difficult to actually analyze the RAM content for any sensitive data? There is so much noise in it
    • foota 2y ago
      I don't think it'd be too hard to find something like private RSA keys in memory, for example.
    • viraptor 2y ago
      A bit hard, but not crazy. You have to potentially deal with not knowing the mappings, but even random blocks will have obvious marks like Json fragments with "password=", crypto keys with common PEM/DER headers, high entropy 8/16/32-byte data, etc.
      • _hyn3 2y ago
        For fun, sometime, try this: sudo strings /dev/sda | more # press q to quit You'll immediately see plain text of various things on your hard drive, complete HTML, etc. Eye opening.
    • g-b-r 2y ago
      No it isn't? I recovered data of mine from ram many times
  • foota 2y ago
    I think this depends on the adversaries you're concerned about. It's unlikely that breaking into a DC and dumping memory is going to be worth it without a very high expected payout. For one, you'd need very high technical expertise.
• bobbiechen 2y ago
  In any threat model where the attacker may gain physical access to servers, RAM interception is a concern. The original poster does care about physical access. I'll mention that unencrypted in-memory data is accessible in pure-software ways too (which usually require root) - debugging tools like GDB, VM snapshots, memory forensics tools, /proc/mem, etc. So unencrypted in-memory data is a problem too if root access (including both by infra-provider insiders and external attackers) is part of your threat model.
• g-b-r 2y ago
  Physical access opens up many possibilities to access the data, definitely not only the cold boot attack you're probably thinking of