If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to decrypt the system if they gain physical access to it? From what I know a hacker with physical access to a running system can steal the hash, but can this be done without physical access?

1 Answer 1


If the attacker has root, then yes, easily. For LUKS, this can be done with dmsetup table --showkey /dev/mapper/whatever | awk '{print $5}' | xxd -r -p to get the master key file, which you can then pass to cryptsetup later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .