Hacker News Reader

> The Gendarmerie also obtained a snapshot of the C&C server’s disk from its hosting provider and shared parts of it with us so we could start to reverse engineer the contents of the C&C server.

That's surprising. Would full disk encryption even help to counter this ?

View on HN

It depends on how the server was hosted. If it was on a cloud, the provider could have suspended the vm and slurped the encryption key directly from memory.

Bare metal would have been a bit harder, but still possible by probing the memory bus.

One could counter this by storing the disk encryption key in a hardware enclave (e.g., SGX).

Or you know, just copy the entire drive while the machine is running....

That would not help you, since the contents on the disk are encrypted. You need to get the key from RAM while the server is turned on AND mirror the disk. Doing just the mirror will not help you.

The copy uses the OS's system calls to transfer data. Thus it will definitely decrypt. If the OS can function, it can read the decrypted data.

An Linux OS with full disk encryption can easily be copied while running as root with a simple rsync. Same with Windows.

Yes, but you need access to the OS, which means you need a login exploit AND privilege escalation exploit, or a hardware-based backdoor or to mess with the RAM bus while the computer is on.

Reply on news.ycombinator.com