[SOLVED] Is it possible that RAM is encrypted too, without special hardware?

273 · 03-28-2015, 11:26 AM

Quote:

Originally Posted by metaschima

In conclusion, yes you can encrypt RAM, but no it won't help you if the VPS host owns the hardware and is the adversary.

What intrigues me is what if your host isn't your adversary but they're merely expected to monitor you in some way? It would be interesting to hear from anyone who works for a VPS hosting company regarding what, if anything, they are expected to log.

Ulysses_ · 03-28-2015, 05:10 PM

Looks like there is a place for the key in the cpu after all, that can be prevented from appearing in snapshots of a VPS:

Quote:

He concluded that modern x86 processors had two register areas where CPU-based kernel encryption was realistic: the SSE registers which could in effect be made privileged by disabling all SSE instructions (and necessarily, any programs relying on them), and the debug registers which were much smaller but had no such issues.

https://en.wikipedia.org/wiki/TRESOR...R.27s_approach

metaschima · 03-28-2015, 05:23 PM

Keep reading:

Quote:

Root access to the encryption keys via the kernel of a running system is possible using loadable kernel modules or /dev/kmem if compiled to support these, but otherwise appears not to be accessible in any known way on a standard running system.

Cold boot attacks on the CPU: - on real processors registers are cleared to zero on both hardware resets and software resets ("Ctrl-Alt-Delete"). However CPU registers are currently vulnerable on virtual machines, since they are reset during simulated hardware resets but not during software resets. The authors deem this an apparent flaw in many implementations of virtual machines, but note that virtual systems would be inherently vulnerable even if this were rectified, since all registers on a virtual machine are likely to be accessible using the host system.

https://en.wikipedia.org/wiki/TRESOR...ulnerabilities

273 · 04-02-2015, 05:08 PM

Quote:

Originally Posted by 273

What intrigues me is what if your host isn't your adversary but they're merely expected to monitor you in some way? It would be interesting to hear from anyone who works for a VPS hosting company regarding what, if anything, they are expected to log.

I am still interested in this angle. I know that it goes against security principals but what if you are just trying to "slip under the radar" using a hosting provider whose employees are more interested in their Friday pizza than your data?