News for hackers. Stuff that matters.

A comment on Putting an end to Retadup: A malicious worm that infected hundreds of thousands. Parent comment

Re:Putting an end to Retadup: A malicious worm that infected... by milankragujevic on Thursday August 29, 2019 @12:11PM (#20830789)
That would not help you, since the contents on the disk are encrypted. You need to get the key from RAM while the server is turned on AND mirror the disk. Doing just the mirror will not help you.
[ Parent | on HN ]
Re:Putting an end to Retadup: A malicious worm that infected... by mox1 on Friday August 30, 2019 @09:51AM (#20838571)
The copy uses the OS's system calls to transfer data. Thus it will definitely decrypt. If the OS can function, it can read the decrypted data.

An Linux OS with full disk encryption can easily be copied while running as root with a simple rsync. Same with Windows.

[ Parent | on HN ]
Re:Putting an end to Retadup: A malicious worm that infected... by milankragujevic on Friday August 30, 2019 @11:47AM (#20839702)
Yes, but you need access to the OS, which means you need a login exploit AND privilege escalation exploit, or a hardware-based backdoor or to mess with the RAM bus while the computer is on.
[ Parent | on HN ]