Let’s say you’ve found a VPN provider that offers everything you need. The provider doesn’t log any user information, the internet speed is fantastic, the payment process is anonymous with Bitcoin, there is a large selection of IP addresses in many countries, and the strongest encryption algorithm possible is used by the provider. What more can you need?
In reality, none of the features listed above matters if the provider doesn't have great physical security as well. In other words, great software security is worthless without equally great physical security.
To understand why physical security is so important, it requires knowledge in computer architecture, which in layman’s terms describes how different components in a computer cooperate and work together. The interesting parts for the purpose of this article are the computer memory (RAM) and the hard drive (HDD).
A VPN provider should be able to offer a good explanation of how integrity can be assured. To simply say that no logs are kept is a weak statement as it doesn’t specify which logs are referred to and fails to mention other ways that user information could be exposed.
The optimal solution is to prevent storing of any information that isn’t needed in order to operate the service. The service needs to be able to resist physical attacks to access user information, in order to prevent being vulnerable against raids.
As you probably know by now, OVPN does not store any logs in any way, but there are additional safety measures we’ve put in place should the worst-case scenario happen: a raid. By not having any hard drives and by running the operating system in the RAM memory, we can make sure that all information is removed within minutes after shutting down a server.
It sounds good, doesn’t it? But it’s not all. Even if you run the OS through the RAM, you could still dump the memory to a singular file and access the information. The contents of the dump file would contain sensitive information like private decryption keys, all the users connected to the server at this point, and buffer and routing caches. As the private key is given in this file, it’s possible to decrypt the network traffic for users.
Fortunately, there are solutions to avoid this from happening. This is where physical security comes in. In this case, there are three things to consider:
- Making sure that only an authorized party can access the servers
- Removing DMA ports (such as Firewire, eSATA) in order to prevent DMA attacks
- Encrypting the memory with TRESOR
If you make sure that points 1 through 3 are taken care of, it’s nearly impossible to access the temporary RAM information. We use our own server cabinets, which are locked, and only our authorized employees have the key. If someone plans to break into the server cabinet, we have burglar alarms in the datacenters as well as security cameras in all directions.
As there are no hard drives in the servers, there is no information to get there.
Even if the servers are attacked and all safety measures fail, there are no DMA ports to extract the information from. A ColdBoot attack wouldn’t be successful either as the information stored on the RAM is encrypted due to the CPU register stores the encryption keys.
All of these physical security measures were installed in October 2014](/en/blog/further-upgrades-of-our-infrastructure/) and have been in effect since then.