It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
theintercept.com
It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
1–10 of 134 posts
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#2An excellent companion-read to the linked article is:
http://ansuz.sooke.bc.ca/entry/23
It builds up a concept of "Colour" as describing information about a thing (distinct from metadata / tagging) which is not necessarily derivable from the thing itself. Most frequently it uses the term to describe provenance, but is careful not to limit the concept. To quote the ansuz' essay above in relation to the linked article:
When we use Colour like that to protect ourselves against viruses or malicious input, we're using the Colour to conservatively approximate a difficult or impossible to compute function of the bits. Either our operating system is infected, or it is not. A given sequence of bits either is an infected file or isn't, and the same sequence of bits will always be either infected or not. Disinfecting a file changes the bits. Infected or not is a function, not a Colour. The trouble is that because any of our files might be infected including the tools we would use to test for infection, we can't reliably compute the "is infected" function, so we use Colour to approximate "is infected" with something that we can compute and manage - namely "might be infected". Note that "might be infected" is not a function; the same file can be "might be infected" or "not (might be infected)" depending on where it came from. That is a Colour.
Once you've left your computer alone with a potential adversary, it has the might-be-compromised Colour. Proving whether it definitely has or has not been compromised is easy for devices which do not have this Colour, but as described in the linked-to article, very difficult or impossible once it has this Colour.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#3I thought it was impossible to prove a negative, generally?
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#4I would think a fully encrypted OS partition would be harder to sneak a backdoor into? Now infecting everything before the OS boots is outside my scope of knowledge, but if you have your partition unencrypted it's definitely much much easier to hijack your OS with physical access.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#5I would think a fully encrypted OS partition would be harder to sneak a backdoor into? Now infecting everything before the OS boots is outside my scope of knowledge, but if you have your partition unencrypted it's definitely much much easier to hijack your OS with physical access.
Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow.
On most Linux setups, that system is the initramfs--if you've ever installed Arch or similar, this is what the `mkinitcpio` step generates--and if you peek in your boot partition, it'll probably be named something like `initramfs-linux.img`.
The initramfs is a (often gzip compressed) ramdisk image for a full-blown tiny Linux system, complete with its own set of coreutils (if you want to see what it contains, run `lsinitcpio -x` on it). It's what handles your boot process, like setting up your keymaps, mounting disks, and of course, decrypting encrypted partitions.
By unpacking, modifying, and repacking the initramfs, it's possible--even trivial--to run whatever code you want as root, or intercept the user's encryption password when they type it in to do the type of conventional unencrypted backdooring you have in mind.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#6I thought it was impossible to prove a negative, generally?
I think you have got a bit confused here. For example Fermat's Last Theorem is effectively "a negative": "no three positive integers a, b, and c satisfy the equation an + bn = cn for any integer value of n greater than 2"
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#7If you care about this, then put the laptop in a tamper-evident bag. Those are necessarily imperfect too; but there's work making tamper-evident seals to resist up to state-level attacks, since that's relevant in stuff like enforcement of nuclear weapons treaties. That succeeds to the extent that you can find a physical effect that's easy to create and measure, but hard to recreate deterministically. (In concept, dump a pile of glitter over your thing. The effort to dump the glitter, take two pictures, and compare is small. The effort to recreate a given glitter distribution flake by flake is large. Likewise for laser speckle from random rough surfaces, and many other effects.)
You could check a laptop for malware later by reading out literally every bit of nonvolatile state, including the BIOS and stuff, and confirming that all changes had expected form (to files you meant to work on, etc.). Of course, then you have to trust the equipment you use for that...
A little weird that he ran the experiment. Did he really suspect that malware was routinely getting installed by attackers with physical access to laptops during business travel? If yes, then why didn't someone notice it calling home or whatever?
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#8Why not put a bounty of bitcoins on your laptop? If it's large enough it becomes worth taking even though that will alert you.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#9If you care about this, then put the laptop in a tamper-evident bag. Those are necessarily imperfect too; but there's work making tamper-evident seals to resist up to state-level attacks, since that's relevant in stuff like enforcement of nuclear weapons treaties. That succeeds to the extent that you can find a physical effect that's easy to create and measure, but hard to recreate deterministically. (In concept, dum…
Did he really suspect that malware was routinely getting installed by attackers with physical access to laptops during business travel? If yes, then why didn't someone notice it calling home or whatever?
I doubt it but his job is to suspect all sorts of things. If you are going to attempt to quantify risk then some experimentation is in order rather than simple speculation. As to "notice it calling home", it is surprising how much is missed. For example, Meltdown n Spectre were predicted many, many years ago ...
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#10I run a dual-boot Debian + Windows 7 laptop, but my default position is to assume the Windows partition is exploitable, so for secure activities I boot Debian.
That boots using an unencrypted /boot partition, but everything else running on luks (one big partition, LVM'd down). I have a VeraCrypt partition which is for files that I want to work on from both operating systems. Works really well, crypted disks doesn't materially impact performance, and gives peace of mind.
The most likely scenario for theft is someone after the hardware, and they'll not spend much effort trying to break into the file system.
I'd be wary if the machine was stolen and then returned, but restoring mbr & /boot partition should be sufficient in that instance.
I've travelled to regions that I considered dubious, if not especially technically sophisticated. I haven't done this, however research suggested the best way of confirming your laptop hasn't been opened is to use a sparkling nail varnish. Dab a small amount on some or all of the case screws, take a close-up photo, store that photo somewhere safe. After the event, take photos of the screws again, and compare. The random patterns are effectively impossible to replicate.
Combined with disabling USB booting, and BIOS admin password, and keeping the OS in sleep -- it should be possible to prove your laptop hasn't been hacked via physical intrusion.