Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot attack? I guess there should be no difference since the virtual machine is using the same hardware RAM like the guest operating system.
1 Answer
Let's say a virtual machine uses full disk encryption to encrypt its virtual disk.
If I have access to the host on which the virtual machine runs, I can simply dump the portions of RAM in use by that virtual machine and recover the encryption key for the virtual disk. Not to mention anything else that happens to be in RAM.
In this scenario you (1) have to trust the host, and (2) would be better served by having the host do the disk encryption, assuming you control it, which would defeat the above attack (though you still have to worry about the cold boot attack and other compromises of the host).
-
I control the hostand the host is locked but still am worried about cold boot attacks so was wondering if letting the camera surveillance run inside a virtual machine might help. As i stated i guess the encryption keys of the VM are still saved in hardware RAM so they are still vulnerable to cold boot? Apr 27, 2015 at 19:31
-
1Physical security is your best defense against cold boot attacks. Apr 27, 2015 at 19:48