Evil Maid goes after TrueCrypt • Hacker News Board

Re: Evil Maid goes after TrueCrypt

#11

Post by timf » Fri, Oct 16, 2009, 10:58 AM UTC

idlewords wrote: post #6

atamyrat wrote: post #5

Earlier quoted context omitted.

My laptop's BIOS settings are password protected. Good luck with booting from CD/USB/Network without hardware tampering.

As the article points out, this is easy to circumvent by removing the hard drive from your laptop. It adds a few minutes to the attack, and requires that the attacker bring a laptop, but you're still hosed.

Not my hard drive, the disk itself is fully encrypted and won't work in other laptops without that bios password (I also use a truecrypt-like thing at the filesystem level). The main attack I need to worry about is someone replacing the keyboard, etc.

Re: Evil Maid goes after TrueCrypt

#12

Post by ErrantX » Fri, Oct 16, 2009, 11:08 AM UTC

I can cut this "insertion" time in half. :) Miniature camera pasted somewhere discrete on the ceiling.

That even bypasses physical (lockbox) security.

(I liked the article but I think she waffled on a bit long about physical security, which TC developers made a good point about, and TPM)

Re: Evil Maid goes after TrueCrypt

#13

Post by timf » Fri, Oct 16, 2009, 11:10 AM UTC

Works on all OSs and only takes a few minutes: replace the laptop keyboard with your own keylogging version. Or insert a device where the serial port connects inside the laptop. Typical 'stealth' hardware based keylogging.

Re: Evil Maid goes after TrueCrypt

#14

Post by timf » Fri, Oct 16, 2009, 11:16 AM UTC

idlewords wrote: post #9

ax0n wrote: post #7

Physical access can almost always be leveraged to full system access.

What is of interest here is the small window of time required. You pretty much have to be in constant possession of your laptop (or a USB key that you religiously use to verify your boot record) in order to have any confidence that it has not been compromised.

That is the premise you should start with IMO; which is why this is not interesting. Absolutely you need to avoid releasing physical control of your machine.

Re: Evil Maid goes after TrueCrypt

#15

Post by Nekojoe » Fri, Oct 16, 2009, 11:16 AM UTC

timf wrote: post #11

idlewords wrote: post #6

Earlier quoted context omitted.

As the article points out, this is easy to circumvent by removing the hard drive from your laptop. It adds a few minutes to the attack, and requires that the attacker bring a laptop, but you're still hosed.

Not my hard drive, the disk itself is fully encrypted and won't work in other laptops without that bios password (I also use a truecrypt-like thing at the filesystem level). The main attack I need to worry about is someone replacing the keyboard, etc.

When you get to that level of protection, the main attack I'd be worried about is the $5 wrench.

http://xkcd.com/538/

Of course as the strip also points out "Actual actual reality: nobody cares about his secrets"

Re: Evil Maid goes after TrueCrypt

#16

Post by timf » Fri, Oct 16, 2009, 11:23 AM UTC

Nekojoe wrote: post #15

timf wrote: post #11

Earlier quoted context omitted.

Not my hard drive, the disk itself is fully encrypted and won't work in other laptops without that bios password (I also use a truecrypt-like thing at the filesystem level). The main attack I need to worry about is someone replacing the keyboard, etc.

When you get to that level of protection, the main attack I'd be worried about is the $5 wrench. http://xkcd.com/538/ Of course as the strip also points out "Actual actual reality: nobody cares about his secrets"

Very true, funny :-) At least with truecrypt you can give them only one of the passwords (it can do that secret "deniable" encrypted partition).

Re: Evil Maid goes after TrueCrypt

#17

Post by tetha » Fri, Oct 16, 2009, 11:23 AM UTC

mahmud wrote: post #3

visitor4rmindia wrote: post #2

This is utterly fascinating. I use TrueCrypt and never dreamt that such a simple attack even existed. Sigh - privacy in the age of information seems to be an impossible dream.

"There are two types of encryption: one that will prevent your sister from reading your diary and one that will prevent your government." -- Bruce Schneier. Addendum: "Provided it's implemented well".

hehe, and then, one realizes that the government might recruit your sister and the dilemma is perfect.

Re: Evil Maid goes after TrueCrypt

#18

Post by pmorici » Fri, Oct 16, 2009, 11:38 AM UTC

timf wrote: post #11

idlewords wrote: post #6

Earlier quoted context omitted.

As the article points out, this is easy to circumvent by removing the hard drive from your laptop. It adds a few minutes to the attack, and requires that the attacker bring a laptop, but you're still hosed.

Not my hard drive, the disk itself is fully encrypted and won't work in other laptops without that bios password (I also use a truecrypt-like thing at the filesystem level). The main attack I need to worry about is someone replacing the keyboard, etc.

What laptop / HD combination does that, or rather how can I tell if mine supports it?

Re: Evil Maid goes after TrueCrypt

#19

Post by dstorrs » Fri, Oct 16, 2009, 11:50 AM UTC

There must be laptops out there with the feature that they lock closed and require some physical opening token (key, combination, etc). Given a sufficiently strong and tamper-evident locking mechanism, you wouldn't need an external lockbox and this attack would be difficult or impossible. (Emphasis on the "sufficiently", of course.)

Re: Evil Maid goes after TrueCrypt

#20

Post by chanux » Fri, Oct 16, 2009, 11:58 AM UTC

Am I the only one who feel that trucrypt dev is just running away from answer here.

Joanna Rutkowska: If I could arrange for a proper lock or an impenetrable strongbox, than why in the world should I need encryption?

TrueCrypt Developer: Your question was: "And how can you determine that the attacker has or has not worked with your hardware?" My answer was a good safety case or strongbox with a good lock. If you use it, then you will notice that the attacker has accessed your notebook inside (as the case or strongbox will be damaged and it cannot be replaced because you had the correct key with you). If the safety case or strongbox can be opened without getting damaged & unusable, then it's not a good safety case or strongbox. ;-)