GPG Memory Forensics by Nils Amiet and Sylvain Pelissier | Nullcon Berlin

This talk explores the enduring relevance of GnuPG, a popular solution for message encryption, even after nearly 25 years since its inception. The speaker discusses techniques to extract passphrases and encryption keys from memory dumps of the gpg-agent process or a full system dump, showcasing the development of Volatility3 plugins for retrieving key material and original plaintext. The presentation also highlights the application of these techniques as defensive countermeasures, particularly in scenarios involving ransomware attacks.