3 ms·
Elcomsoft Forensic Disk Decryptor [0] can find the decryption keys from the RAM dumps or hibernation files. The RAM can be accessed using a DMA malware from th
by conductor 13y ago
Elcomsoft Forensic Disk Decryptor [0] can find the decryption keys from the RAM dumps or hibernation files.
The RAM can be accessed using a DMA malware from the GPU/NIC/Intel ME or other devices which have a (micro-)processor and can use DMA [1, just submitted].
[0] - http://www.elcomsoft.com/efdd.html http://www.elcomsoft.com/efdd.html
[1] - https://news.ycombinator.com/item?id=6457069 https://news.ycombinator.com/item?id=6457069
- tedunangst 13y agoYour backdoored DMA capable NIC can also just copy the plaintext out of RAM without futzing around with the key.
- conductor 13y agoCopy the plaintext of what? The password? The encryption programs usually don't keep the password in the RAM longer than required, but the key must be always there. I just wanted to say that keeping the decryption keys out of RAM and Disks is not that paranoid because there are techniques which allow extraction of data from the RAM: cold boot, ordinary malware/rootkits, DMA malware.
- tedunangst 13y agoThe plaintext of whatever you're encrypting. Presumably you're going to actually use these debug register AES keys to encrypt or decrypt something more interesting.
- rdl 13y agoThe sneaky thing is to do like TreVisor, and I believe the commercial company PrivateCore, to encrypt all memory outside the CPU die (L1/L2, maybe L3?), by pinning the hypervisor and encryption routines to something running inside, and encrypting everything which leaves (and presumably doing some integrity protection). HN user sweis works for PrivateCore; I've talked to them a few times and they seem really interesting, although I think a more conventional HSM makes more sense for some applications, and Intel SGX is going to make the whole thing a lot more interesting in 2-3 years.
- dlitz 13y agoThis isn't just about surreptitiously installing a compromised PCI card into a desktop PC. It affects every machine with a FireWire, Thunderbolt, or PCMCIA/ExpressCard port, i.e. most stolen corporate laptops. https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack
- rdl 13y agoVT-d addresses this. Standard on most Intel Core processors for a couple years.
- tga_d 13y agoI've heard that it could address it in theory but hasn't actually been used for that yet. Do you have a source saying it does this by default, or failing that, how to set it up to do that?
- sweis 13y agoIOMMU with VT-d is present, but not utilized by some major commercial operating systems and hypervisors. There are also some implementation vulnerabilities in specific OSes which are not yet publicly disclosed.
- sweis 13y agoHere's a video of a malicious PCIe device extracting both plaintext and encrypted main memory: http://www.youtube.com/watch?v=chvJpEmXvDk http://www.youtube.com/watch?v=chvJpEmXvDk