Physically break into box? (Memory & disk)

Question

I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it encrypted with encfs. Just in case a hacker gets some kind of access, encfs can only mount the drive if my password is correct (SSH keys won't mount it, resetting root password will not mount as the new password is an incorrect passphrase)

My question is can my VPS host break into my box? Physically the data is encrypted. I believe root can be changed without resetting the box? If so then they can have access to my already mounted filesystem? If another user with no permission is logged in can the user do something to access the ram and dump sensitive data? can the VPS host easily read the contents of my RAM?

Note: This is hypothetical. I'm thinking about if I have big clients I want to know how much security I can promise and this popped into mind. I'd rather not host a box at home nor have the pipes to support it.

Answer 1

As a general rule, physical access to the machine is all that's ever needed to compromise it. You are, after all, trusting that what the machine tells you is true; a person with physical access can void that trust. Consider that an attacker with physical access can theoretically do anything (including installation of hardware/firmware rootkits, etc).

If the data is encrypted, that's a good first step, but at every step (when you are entering your authentication to decrypt the volume, etc) you are trusting the computer not to lie to you. That is much more difficult when you do not have personal control over the physical machine.

As for some of your specific queries:

If another user with no permission is logged in can the user do something to access the ram and dump sensitive data?

In general, no. Raw memory access is a privileged operation.

can the vps host easily read the contents of my ram?

Yes. Isolation in a virtual environment means that you have no control over the external operating environment that the VPS is running within. This operating environment could indeed do this.

Answer 2

Since the data has to be decrypted to be usable, it will be available in an unencrypted state during runtime.

You should treat it as though the provider can access the live running system at any time without your knowledge. This includes data at rest on disk, data contained in memory (such as decryption keys) and even any keystrokes you send (i.e., assume any typed password can be observed and recorded).

Answer 3

There is no way to be safe against a malicious hosting provider, they can access your data no matter how you try to avoid it. A few simple examples:

1. Encrypted SSH traffic can be discovered by taking the host key from the host filesystem and putting another SSH server as a man-in-the-middle that decrypts the traffic and negotiates with your SSH server.
2. Encrypting the root filesystem or the ssh host key would require you to enter the password at a terminal, and since the terminal is controlled by the provider, it cannot be considered safe.

The only reasonably safe method of having a server is buying, installing a box and putting it in your own cage in a shared or private hosting environment, setting up an encrypted filesystem, a trusted boot device, a physical lock on the cage, and secure console access.

Even this might have holes in it due to things like security issues in software versions, lockpicking (for the physical lock).