110
votes
How to prevent a hosting company from accessing a VM's encryption keys?
You can't, plain and simple. If you don't trust the hosting company, you don't host with them. This is law #3 from 10 immutable law of security:
Law #3: If a bad guy has unrestricted physical ...
- 31.6k
16
votes
How to prevent a hosting company from accessing a VM's encryption keys?
so that it would not be economically viable to spend time & resources to get them.
I hate to break it to you, but you simply aren't that important. No-one knows you or your web app. So it's ...
- 835
13
votes
How to prevent a hosting company from accessing a VM's encryption keys?
In theory, you should be able to use the trusted hardware features of modern CPUs to run your disk encryption, or even your entire VM, inside a tamper-resistant part of the CPU, having all the data on ...
- 305
5
votes
Way to protect from cold boot attack
Windows 10 Latest patch can protect cold boot attack?
No.
DDR3 or DDR4 RAM still have vulnerability?
DDR3 and DDR4 retain memory for a shorter period of time than DDR2, but cold boots are still ...
- 67.1k
4
votes
How to prevent a hosting company from accessing a VM's encryption keys?
Lie Ryan's answer is the right one, but beyond colocation, which still has physical attack surface at the host's premises, one additional possibility is using the hosting provider just to get you a ...
4
votes
How to prevent a hosting company from accessing a VM's encryption keys?
I don't fully trust for some reason
Trust them in what way? Do you believe they may be incompetent or do you think they may be malicious?
If merely incompetent, you'll probably get reasonable ...
- 1,299
4
votes
How to prevent a hosting company from accessing a VM's encryption keys?
Microsoft has a possible solution for this called Shielded VMs, these are specifically intended for the attack vector that some malicious actor has administrative access to the hypervisor. An example ...
- 808
3
votes
How Secure is Storing Cryptographic Information into the CPU Register instead of RAM
An answer obviously depends on the kind of CPU you are talking about.
For example, with general-purpose registers on a modern x86 CPU, you have several problems:
CPU registers are mostly 64 bits ...
- 9,283
2
votes
Is setting a firmware password on a Macbook enough to prevent cold boot attacks?
My understanding is that the Macbook Pro Retina has had soldered on RAM since 2012 and all other Macbook's since 2016. So quickly removing the RAM is not a likely attack. This would involve ...
- 3,012
2
votes
Is setting a firmware password on a Macbook enough to prevent cold boot attacks?
From wikipedia
Alternatively, the memory modules are removed from the original system and quickly placed in a compatible machine under the attacker's control, which is then booted to access the ...
- 3,843
2
votes
Cold-boot attack example in the real world
Yes, there are examples of cold boot attacks in the wild. An archived presentation gives an example of live memory acquisition on a server when DMA is not possible and when the native BIOS ...
- 67.1k
2
votes
Methods of cold boot attacks in the wild
While I don't have any information about what techniques are in use in the wild, this academic paper drills into cold boot attacks on DDR4 DRAM attached to Intel Skylake CPUs.
Here are the most ...
2
votes
Are there volatile memory chips which dont retain data after power off?
There exist DRAM ICs where the power keeps bit lines from shorting to each other when powered. This is done by burning power to keep the "clamps" open if you "unplug" them, you ...
- 536
2
votes
Way to protect from cold boot attack
The idea of a coldboot attack is to freeze the RAM while the operating system is still running (for example whilst you are on lunch break and your box is running but the screenlocker is enabled). This ...
- 103
2
votes
What type of attacks can be carried against an OS with FDE, if we assume OS and FDE are implemented correctly?
Attack vectors to consider against a computer with a locked screen, the example you gave about the cold boot attack is one that would require physical access.
0day exploits/exploits for default ...
- 41
1
vote
Is a cold-boot-attack on a bitlocker key in TPM still possible, if I use the TPM with a different drive in the meantime?
Typically the TPM is keyed to bios settings and hardware pieces and settings and the boot executables on the disk. If any of that changes, the TPM will not release its key and it is specifically ...
- 2,041
1
vote
Booting from removeable media, evil maid, and others?
You have it a bit backwards.
The evil maid attack is when the evil maid brings in bootable removable media and boots your system on it and then accesses your filesystem bypassing all privilege checks.
...
- 2,041
1
vote
Accepted
RAM as a attack target
Since you tagged this question as "cold boot attack" and "forensics", I presume you're asking about a physical memory dump.
These dumps are usually acquired by something like ...
- 136k
1
vote
How to prevent a hosting company from accessing a VM's encryption keys?
The cloud ultimately is someone else's computer, and someone else's rules. If you are looking for physical access security, the best path may be to host your own physical server, or get a dedicated ...
- 111
1
vote
Interpreting this F-Secure Video of a DMA-Attack
What is happening at the 50-second mark?
Looks like a JTAG-probe or similar, possibly to reset firmware passwords.
Why does he insert the USB boot-device before doing whatever he does next? Was ...
- 16.9k
Only top scored, non community-wiki answers of a minimum length are eligible