I recently discovered the subject of cold boot attacks which are able to extract the encryption key of the ram memory after the computer has shut down. and from what I understand is that law enforcement can bust into people homes and pour liqued nitrogen over peoples computer for the key.

But then I thought of this: if you can steal the key out of the ram memory, wouldn't it make more sense if they just installed malware onto the suspects computer to get it(if it is possible ofcourse)? so the finale question is: is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack?

  • I believe it is common protocol to erase secret key material from memory as soon as it is no-longer needed. This is certainly true of ephemeral keys to provide forward secrecy.
    – TruthSerum
    Jun 14, 2016 at 7:17
  • well i read the veracrypt for example uses encryption on the fly, which means they store the key in ram so they can constantly decrypt the files you need(to prevent that you need to decrypt the entire system when you boot up, and encrypt it entirely agai when you shut down) so if this key is located in ram, it should be retrievable i think.
    – blacklight
    Jun 14, 2016 at 7:20
  • If the malware runs as admin/root it can trivially read the key from RAM. Jun 14, 2016 at 7:24
  • How do you propose for the attacker to install the malware? Jun 14, 2016 at 7:24
  • well considering that someone who encrypts his laptop knows a bit about security, i think something like leading the suspect via a fake dns to a fake website which infects the suspect with the malware via java script for example.
    – blacklight
    Jun 14, 2016 at 7:28

1 Answer 1


is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack?

Of course it is possible. The malware requires to achieve privilege elevation ad access the encryption driver's memory; both things can be made difficult, but are by no means impossible.

Why law enforcement doesn't use this method (which actually does not require stealing any key: usually when the FDE is unlocked, the disk is accessible by any process, malware included, so the problem is just how to exfiltrate the purloined information): who says they don't? Where I live we got a nice scandal not too long ago, whereby a software firm got hacked that worked for various governments. They developed what was, for all intents and purposes, targeted malware.

Cold boot attacks and malware aren't mutually exclusive - you may have both at your disposal, and employ whatever best suits the specific case at hand.

From a legislatory point of view I believe that cold boot attacks are considered equivalent to a seizure, while malware installation is more of a gray area: it is somewhat equivalent to an ambush or check point, but it also entails altering the targeted system, which in some cases may render any evidence gathered utterly unusable - the equivalent of forcing open a suspect's door lock. Yes, law enforcement can enter at any moment, but so could theoretically anyone else, making any evidence questionable at last.

For example, if the malware allowed remote control of the targeted system, care should be exercised to ensure that no unauthorized access to the malware is then possible by parties unknown, for purposes of planting the very evidence the malware might then turn out.

Finally, the malware might be detected and even subverted, making it less desirable from a law enforcement's point of view.

  • thank you, this cleared things up quite a bit, since you see when thinking all the factors you need to think about when preforming a cold boot attack, and with the rise of faster ram (ddr 3 and 4 are harder to cold boot than ddr 2 for example) , it sound more logical to just install malware to extract the encryption key, and then use the key to decrypt the target computer once it has been seized
    – blacklight
    Jun 14, 2016 at 8:29
  • @blacklight I'd add that the government has run into jurisdictional issues with remotely delivered malware that aren't present with cold-boot attacks or "seizure". At least one of the defendants identified by "operation torpedo" was able to have his case dismissed on jurisdictional grounds - the search warrant on which the FBI based the operation was issued in a jurisdiction he (and his computer) had never visited, so his lawyer was able to get the case tossed. Jun 14, 2016 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .