Reply to thread

Message

<blockquote data-quote="windscribe" data-source="post: 952847" data-attributes="member: 58131">&gt; Even a ram based server needs to have some persistent storage That is not true. You can perform a network boot by fetching initrd, kernel and the filesystem from a remote location. ControlD (our DNS service) operates exactly like that, and is a test-bed for the Windscribe RAM-only nodes. The process is simple:1. Get a server with any installed OS on disk2. Deploy the &quot;Neuralyzer&quot; tool, which modifies GRUB to perform a network boot3. Reboot the machine4. Machine boots into an in-memory image with no HD mounted into the OS (since it contains the original OS supplied by the hosting company) In the even of a power cycle/reboot, the network boot would not be authorized (the endpoints that deliver intrd, kernel and fs are gated). Even if that were to fail and be exploited, the OS image contains no secrets or configs which are templated when a human presses a button.If you&#039;re the leader of ISIS, and were traced to a VPN server, and the gov goes to extraordinary lengths by freezing the RAM and somehow getting all contents of it, perfectly intact, it still accomplishes nothing, now that servers don&#039;t share keys, have short lived certificates and client side mitigation that prevents server impersonation even with valid keys in possession by the attacker. We&#039;re gonna do a technical writeup about this when the system is deployed to production, and probably open source the Neuralyzer tool we made. It&#039;s really neat.</blockquote>

[QUOTE="windscribe, post: 952847, member: 58131"] > Even a ram based server needs to have some persistent storage That is not true. You can perform a network boot by fetching initrd, kernel and the filesystem from a remote location. ControlD (our DNS service) operates exactly like that, and is a test-bed for the Windscribe RAM-only nodes. The process is simple: 1. Get a server with any installed OS on disk 2. Deploy the "Neuralyzer" tool, which modifies GRUB to perform a network boot 3. Reboot the machine 4. Machine boots into an in-memory image with no HD mounted into the OS (since it contains the original OS supplied by the hosting company) In the even of a power cycle/reboot, the network boot would not be authorized (the endpoints that deliver intrd, kernel and fs are gated). Even if that were to fail and be exploited, the OS image contains no secrets or configs which are templated when a human presses a button. If you're the leader of ISIS, and were traced to a VPN server, and the gov goes to extraordinary lengths by freezing the RAM and somehow getting all contents of it, perfectly intact, it still accomplishes nothing, now that servers don't share keys, have short lived certificates and client side mitigation that prevents server impersonation even with valid keys in possession by the attacker. We're gonna do a technical writeup about this when the system is deployed to production, and probably open source the Neuralyzer tool we made. It's really neat. [/QUOTE]

Verification