Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re in the front of a Linux computer, you need a root access. What do you do?

jovicailic.org

Post reply on HN
Print view View original

21–30 of 35 posts

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#21

Post by octo_t »

yuvadam wrote: post #11

Not sure what this article is trying to say. I can gain "root access" just by dismantling the hard drive and mounting it on a machine I own. This is exactly why everybody should be using full-disk encryption. It is ridiculously easy to set it up both on OS X (with FileVault) and Linux (with a plethora of options), and even on Windows machines. There is absolutely no reason why not to do this.

I would rather use FileVault than TrueCrypt on OSX to be honest.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#22

Post by thejosh »

emilw wrote: post #19

If enabled, you use a firewire connection. You don't even need to reboot and can connect as root to any running processes and filesystems. http://www.breaknenter.org/projects/inception/ Yes, that is actual working technology.

this tool will give me nightmares.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#23

Post by marvin »

emilw wrote: post #19

If enabled, you use a firewire connection. You don't even need to reboot and can connect as root to any running processes and filesystems. http://www.breaknenter.org/projects/inception/ Yes, that is actual working technology.

This is a frighteningly effective hack, which once again underscores that if your attacker has physical access to the machine, you're hosed. I've seen this attack demonstrated live on Windows Server. It just uses DMA to search the memory and skip the subroutine that checks whether the password entered was valid.

Just put glue in the firewire connector, you say? Well, for instance most laptops that can be docked are firewire-accessible through the docking port. The firewire interface is also reachable through a USB adapter. So you'd have to glue the USB ports shut as well. (Impractical). Even if you do all this, most motherboards have the FireWire interface enabled on a PCI level, even if there are no physical PCI ports on the computer. So against this attack you'd be pretty much hosed regardless, unless you use a chipset that explicitly doesn't implement FireWire.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#24

Post by yuvadam »

octo_t wrote: post #21
yuvadam wrote: post #11

Not sure what this article is trying to say. I can gain "root access" just by dismantling the hard drive and mounting it on a machine I own. This is exactly why everybody should be using full-disk encryption. It is ridiculously easy to set it up both on OS X (with FileVault) and Linux (with a plethora of options), and even on Windows machines. There is absolutely no reason why not to do this.

I would rather use FileVault than TrueCrypt on OSX to be honest.

I meant to write FileVault, it's the superior solution for OS X, I agree.

Edited.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#26

Post by j_s »

marvin wrote: post #23
emilw wrote: post #19

If enabled, you use a firewire connection. You don't even need to reboot and can connect as root to any running processes and filesystems. http://www.breaknenter.org/projects/inception/ Yes, that is actual working technology.

This is a frighteningly effective hack, which once again underscores that if your attacker has physical access to the machine, you're hosed. I've seen this attack demonstrated live on Windows Server. It just uses DMA to search the memory and skip the subroutine that checks whether the password entered was valid. Just put glue in the firewire connector, you say? Well, for instance most laptops that can be docked are f…

To prevent this attack, disable auto-loading of FireWire drivers within the OS. I believe one of the Linux driver stacks already does this & OS X protects itself when the machine is locked.

Also, FireWire over USB is repeatedly mentioned as not working.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#27

Post by afhsfsfdsss88 »

Piskvorrr wrote: post #2

Grub is password-protected, what do you do? (Boot from a live distro and chroot into the on-disk one)

This is what came to me first. I have unrestricted physical access?

I probably own the machine. If the data on the storage is not encrypted, I own that too.

If I don't want to disassemble anything, I just plug in a liveUSB and it's all mine.

If the BIOS has USB/CD boot disabled? I pull the CMOS battery.

If that fails? The google probably knows the BIOS reset sequence for your board and soon so will I.

=======================================================================

Physical security is important too and FDE is not optional. [Even if you have nothing to hide]

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#28

Post by SixSigma »

If it has sensitive data on it, the Linux computer should be locked in a room. Physical access = ownership, every sysadmin knows that. Plan 9 terminals don't have passwords for user accounts, if you want access to privileged data you then have to authenticate with the dedicated authorization server. Linux is a 1960s OS, it boggles the mind people even still use it.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#29

Post by easy_rider »

SixSigma wrote: post #28

If it has sensitive data on it, the Linux computer should be locked in a room. Physical access = ownership, every sysadmin knows that. Plan 9 terminals don't have passwords for user accounts, if you want access to privileged data you then have to authenticate with the dedicated authorization server. Linux is a 1960s OS, it boggles the mind people even still use it.

Hydrocarbon based fuels are 1850's tech. It boggles my mind people even still use it.

Re: You’re in the front of a Linux computer, you need a root access. What do you do?

#30

Post by Karunamon »

octo_t wrote: post #21
yuvadam wrote: post #11

Not sure what this article is trying to say. I can gain "root access" just by dismantling the hard drive and mounting it on a machine I own. This is exactly why everybody should be using full-disk encryption. It is ridiculously easy to set it up both on OS X (with FileVault) and Linux (with a plethora of options), and even on Windows machines. There is absolutely no reason why not to do this.

I would rather use FileVault than TrueCrypt on OSX to be honest.

From an ease of use standpoint, maybe, but from a "less-likely-to-be-compromised" standpoint? TC every day of the week and twice on Sunday.

Big-company encryption software cannot be trusted anymore. (If it ever could have been...)

Post reply on HN