2

Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot attack? I guess there should be no difference since the virtual machine is using the same hardware RAM like the guest operating system.

Improve this question

1 Answer 1

Reset to default
2

Let's say a virtual machine uses full disk encryption to encrypt its virtual disk.

If I have access to the host on which the virtual machine runs, I can simply dump the portions of RAM in use by that virtual machine and recover the encryption key for the virtual disk. Not to mention anything else that happens to be in RAM.

In this scenario you (1) have to trust the host, and (2) would be better served by having the host do the disk encryption, assuming you control it, which would defeat the above attack (though you still have to worry about the cold boot attack and other compromises of the host).

Improve this answer
2
  • I control the hostand the host is locked but still am worried about cold boot attacks so was wondering if letting the camera surveillance run inside a virtual machine might help. As i stated i guess the encryption keys of the VM are still saved in hardware RAM so they are still vulnerable to cold boot?
    – Junior J. Garland
    Apr 27, 2015 at 19:31
  • 1
    Physical security is your best defense against cold boot attacks.
    – Michael Hampton
    Apr 27, 2015 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .