AES Finder – the utility to find AES keys in running process memory

Re:AES Finder – the utility to find AES keys in running proc... by dtech on Sunday September 06, 2020 @10:41AM (#24391650)

USB-C+Thunderbolt or eSATA with a vulnerable controller. I know modern OSes have protection against driveby-DMA, but don't know if they protect against memory dump if the "user" - or attacker who gained access to a logged in system - consents.

All these attacks target decryption keys in memory, so they don't work on devices which are turned off.

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by Drip33 on Sunday September 06, 2020 @10:54AM (#24391741)

I'm assuming the computer is "locked" but online, and no users consent to logging in to run anything. Will any of these methods still work if Firewire drivers are disabled?

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by wongarsu on Sunday September 06, 2020 @01:29PM (#24392988)

In that case USB-C/Thunderbolt won't work, in the default config you need to trust the device and cable before anything too interesting can happen. This can be turned off via bios setting though, so there's room for misconfiguration.

E-SATA or PCIe hotplug might still work. However the former is getting less common, and the latter is uncommon in consumer mainboards.

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by ra on Sunday September 06, 2020 @11:21PM (#24396359)

Thunderbolt in some cases: https://thunderspy.io/

[ Parent | on HN ]