1

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to decrypt the system if they gain physical access to it? From what I know a hacker with physical access to a running system can steal the hash, but can this be done without physical access?

1

If the attacker has root, then yes, easily. For LUKS, this can be done with dmsetup table --showkey /dev/mapper/whatever | awk '{print $5}' | xxd -r -p to get the master key file, which you can then pass to cryptsetup later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.