Hacker News Reader

Comment by arccy | Hacker News Reader

What's the threat model that ram interception is an issue? I think the upsell is entirely reasonable, you get charged more for weird compliance demands.

View on HN

In any threat model where the attacker may gain physical access to servers, RAM interception is a concern. The original poster does care about physical access.

I'll mention that unencrypted in-memory data is accessible in pure-software ways too (which usually require root) - debugging tools like GDB, VM snapshots, memory forensics tools, /proc/mem, etc. So unencrypted in-memory data is a problem too if root access (including both by infra-provider insiders and external attackers) is part of your threat model.

What's a threat model where RAM intercept wouldn't be an issue?

Isn't it difficult to actually analyze the RAM content for any sensitive data? There is so much noise in it

I don't think it'd be too hard to find something like private RSA keys in memory, for example.

A bit hard, but not crazy. You have to potentially deal with not knowing the mappings, but even random blocks will have obvious marks like Json fragments with "password=", crypto keys with common PEM/DER headers, high entropy 8/16/32-byte data, etc.

For fun, sometime, try this:

    sudo strings /dev/sda | more # press q to quit

You'll immediately see plain text of various things on your hard drive, complete HTML, etc. Eye opening.

No it isn't?

I recovered data of mine from ram many times

I think this depends on the adversaries you're concerned about. It's unlikely that breaking into a DC and dumping memory is going to be worth it without a very high expected payout. For one, you'd need very high technical expertise.

Physical access opens up many possibilities to access the data, definitely not only the cold boot attack you're probably thinking of

Reply on news.ycombinator.com