4 ms·

That's why they take memory snapshot first, which is trivial with VPS and then pick encryption keys from it to access encrypted volumes. This is well known meth

That's why they take memory snapshot first, which is trivial with VPS and then pick encryption keys from it to access encrypted volumes. This is well known method and works with pure hardware machines too with physical access. It's great question when you get to server, to shut it down or leave on. If on, it could destroy data, if turned off encryption keys are gone. I think it would require some individual case analysis before deciding which one is better approach.

etherael 13y ago
Isn't the pure hardware method for memory snapshots some ridiculously complex mechanism with freezing the memory and quickly transferring it to a reading device? If you're going to pull this, you need to know in advance that it's necessary, that's not some minor thing that everyone is going to just do automatically, it's an extra, complicated step it's easy to screw up. That said, I acknowledge the possibility of compromise in the aforementioned scenario, but once again I don't understand people who always jump to the "I am vulnerable to this narrow threat model, ergo, I should not bother to protect myself against any threat models". Especially when the measures you can take to protect yourself most likely will address the actual threat models you are liable to encounter.
- lloeki 13y ago
  > Isn't the pure hardware method for memory snapshots some ridiculously complex mechanism with freezing the memory and quickly transferring it to a reading device? With Virtual Private Servers, it's trivial to do the virtualized version of this through the hypervisor.
  - etherael 13y ago
    My original statement said "dedicated server". The response said; "virtual server attack, also works with pure hardware machines". The only version of this attack that is relevant to the original statement is one that works on a dedicated server, so re-stating that it's trivial to do this against a virtual private server isn't really adding anything to the conversation.
- mike-cardwell 13y ago
  "ridiculously complex mechanism" ... Not really. Anyone with the ability to stick a USB stick in a USB port and hit a power reset button can pull off this attack: http://www.mcgrewsecurity.com/tools/msramdmp/ http://www.mcgrewsecurity.com/tools/msramdmp/
  - etherael 13y ago
    Interesting stuff. TRESOR might not be overkill after all.
  - noinsight 13y ago
    Hmm, that requires USB booting though, if you disable that from the BIOS and password protect it, they can't really use this method. If they pull the battery the machine needs to be turned off and so the RAM will clear.
    - etherael 13y ago
      You don't get BIOS access to low cost dedicated servers on OVH, even though they're dedicated, you can't KVM them. mid to high range ones you can though so that might be a workable solution there. Also, they can still rip the ram out and nitrogen it.
oijaf888 13y ago
How do you do that with a pure hardware machine with physical access without rebooting the machine? Even if you freeze the memory with liquid nitrogen and extract the data from it, that process results in the server needing rebooted afaik. Obviously I'm assuming there's no 0-day you can just enter in via the serial console or similar.
- e12e 13y ago
  You might chill the RAM, reboot, read out the encryption keys, mirror the disks, verify that you can decrypt it -- and then leave the server off -- mail the customer a notice saying the server rebooted due to a power glitch. At this point you have pretty much everything on hand to help you fool the customer into believing everything is ok (eg: replace the whole physical machine with a vm...). Come to think of it -- if you know the hardware in the machine, you probably could replace the machine with a vm anyway -- just mirror the disks and go.

etherael 13y ago

Isn't the pure hardware method for memory snapshots some ridiculously complex mechanism with freezing the memory and quickly transferring it to a reading device? If you're going to pull this, you need to know in advance that it's necessary, that's not some minor thing that everyone is going to just do automatically, it's an extra, complicated step it's easy to screw up. That said, I acknowledge the possibility of compromise in the aforementioned scenario, but once again I don't understand people who always jump to the "I am vulnerable to this narrow threat model, ergo, I should not bother to protect myself against any threat models". Especially when the measures you can take to protect yourself most likely will address the actual threat models you are liable to encounter.

lloeki 13y ago
> Isn't the pure hardware method for memory snapshots some ridiculously complex mechanism with freezing the memory and quickly transferring it to a reading device? With Virtual Private Servers, it's trivial to do the virtualized version of this through the hypervisor.
- etherael 13y ago
  My original statement said "dedicated server". The response said; "virtual server attack, also works with pure hardware machines". The only version of this attack that is relevant to the original statement is one that works on a dedicated server, so re-stating that it's trivial to do this against a virtual private server isn't really adding anything to the conversation.
mike-cardwell 13y ago
"ridiculously complex mechanism" ... Not really. Anyone with the ability to stick a USB stick in a USB port and hit a power reset button can pull off this attack: http://www.mcgrewsecurity.com/tools/msramdmp/ http://www.mcgrewsecurity.com/tools/msramdmp/
- etherael 13y ago
  Interesting stuff. TRESOR might not be overkill after all.
- noinsight 13y ago
  Hmm, that requires USB booting though, if you disable that from the BIOS and password protect it, they can't really use this method. If they pull the battery the machine needs to be turned off and so the RAM will clear.
  - etherael 13y ago
    You don't get BIOS access to low cost dedicated servers on OVH, even though they're dedicated, you can't KVM them. mid to high range ones you can though so that might be a workable solution there. Also, they can still rip the ram out and nitrogen it.

oijaf888 13y ago

How do you do that with a pure hardware machine with physical access without rebooting the machine? Even if you freeze the memory with liquid nitrogen and extract the data from it, that process results in the server needing rebooted afaik. Obviously I'm assuming there's no 0-day you can just enter in via the serial console or similar.

e12e 13y ago
You might chill the RAM, reboot, read out the encryption keys, mirror the disks, verify that you can decrypt it -- and then leave the server off -- mail the customer a notice saying the server rebooted due to a power glitch. At this point you have pretty much everything on hand to help you fool the customer into believing everything is ok (eg: replace the whole physical machine with a vm...). Come to think of it -- if you know the hardware in the machine, you probably could replace the machine with a vm anyway -- just mirror the disks and go.