Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said:
Removing RAM or components from a desktop or a laptop
Here's a screenshot:
I understand that removing stuff like storage drives is a security risk but removing RAM? The maximum it can do is slow down the system, but how else is that a security risk?
RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example.
Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen.
For more information, see the Wikipedia article for Cold Boot Attack.
If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is secure and don't clear everything, so it could (and often does) happen that your RAM memory contains passwords and privacy-sensitive data.
Now RAM is said to lose data upon power loss, but it does so slowly enough and predictably enough to provide a window of time where attackers can read the contents looking. This is called a cold boot attack.
Without more context it's not completely clear, but combined with the line above ("stealing equipment", not "...storage devices/computers") they could be referring to simple theft. This was an issue a few years ago when RAM prices were high - it's very portable.
Alternatively DOS-by-theft could be an issue. The same slide refers to "Cutting a fibre optic backbone" which would prevent communication, and not "breaking into" the fibre which would be more likely to mean eavesdropping. Of course, if your recovery procedures in the event of a cable break or equipment theft aren't as secure as your mainline processes, that could leave you exposed to data loss.
Removing RAM may force a system to swap more so maybe there's a small but higher chance that sensitive information that is stored in RAM is written to a hard drive where it is much easier to recover.
Depending on what the system was doing, there might be a lot of value in freezing the RAM and dumping it to analyze it.
RAM takes many shapes--many types of servers have special RAM that have parity bits in them, so on top of the RAM not immediately 'forgetting' the last thing recorded in a block, it's actually much more likely if you really really cared about recovering what was on that RAM--it's much more possible given server RAM is built for having error-protection versus homeuser RAM.
The type of attack, if the attackers know what they're looking for, is going to be very focused on a certain task. So that might be tapping a line, stealing hardware, planting a keylogger, etc. But it's definitely possible to steal memory on RAM--it's a mess to analyze, but if you're planning a heist to steal RAM, you probably have someone with the technical know-how to profit off it.
The slide mentions that these are physical attack vectors. I don't know the full context of the slide deck, but even just removing RAM from a system can bring an application or system to its knees.
The goal of most attacks, physical or cyber, is to disrupt service, steal information, or gain backdoor access for long-term shenanigans (botnets, etc.). While theoretically data can be stolen from RAM that's just been unplugged, I think the bigger threat here is more along the lines of a denial of service attack.
If physical access to a server can be gained by an attacker, stealing RAM crucial to the operation of that server could result in the server failing. If you steal all the RAM it won't just slow the system down as you mention in your question, rather it will outright prevent the system from functioning. Then again, stealing only some of the RAM in a critical system would be more discrete, and if unnoticed, operators might have a hard time identifying the root cause of system malfunction (especially if the system is heavily reliant on RAM, such as an in-memory database application, e.g. a TimesTen DB).
The bullet point itself could, of course, be expanded to any physical attack on the hardware itself, but stealing RAM is probably the most discrete and easiest to pull off physical vector for an attacker who only has a brief window of opportunity to access the hardware.
Just to reiterate what others have said, not only could you shut down a server or device by removing all of its ram, you could steal cryptographic keys. The process generally looks like freezing the ram, removing it, and then placing it into a different machine where it can be analized. This works because while usually when ram loses power, all data is lost, but when the ram is frozen to very low temps, the electrons and therefore the data are essentially 'stuck' in the ram, giving an attacker enough time to remove it from power and then reconnect it on a malicious system.
It is possible to steal data from RAM.
In the condition that 1) you have external connection to the RAM data and address bus; 2) you will have the way that allow all data to be send to data bus of the RAM (Only possible to have a program to do that without affect the system running); 3) the program should be running at the same level of kernel;
In short, you have to have a program(or virus or security hole) to be able to steal data from RAM.
removing it while the system is still runningIt's no surprise the data wasn't lost.