Evil Maid goes after TrueCrypt • Hacker News Board

Re: Evil Maid goes after TrueCrypt

#41

Post by yummyfajitas » Fri, Oct 16, 2009, 2:03 PM UTC

cellis wrote: post #28

ErrantX wrote: post #12

I can cut this "insertion" time in half. :) Miniature camera pasted somewhere discrete on the ceiling. That even bypasses physical (lockbox) security. (I liked the article but I think she waffled on a bit long about physical security, which TC developers made a good point about, and TPM)

The problem with this is you're assuming the target will actually access his encrypted data while in the hotel room. If you really want to cut it in half, just kidnap him and hit him with this $5 wrench until he tells us the password. We're breaking laws, but hey, whose counting?

This lets the target (and his collaborators) know he is compromised, and may make any information gained worthless.

Re: Evil Maid goes after TrueCrypt

#42

Post by noonespecial » Fri, Oct 16, 2009, 2:22 PM UTC

Whenever I suspect I might be somewhere where there's a keylogger running (public terminal etc) and I absolutely have to enter a password anyway, I just use the mouse to enter it out of order (and click away to throw in some random junk) while typing it in. Thwarts screen grabbers and keyloggers.

Re: Evil Maid goes after TrueCrypt

#43

Post by zargon » Fri, Oct 16, 2009, 2:47 PM UTC

This is why your decryption boostrap should never be on the hard drive. It should be on a usb stick along with your encrypted keys. This is elementary "something you have + something you know" security. The evil maid can't patch a bootloader that isn't there. And if he installs a keylogger, he's still out of luck because he only has your passphrase, not your decryption keys. He would also have to install a device that copies your key file somehow.

Sure, there are plenty of other attack vectors, but this takes the problem out of the evil maid category.

Re: Evil Maid goes after TrueCrypt

#44

Post by hmmmm » Fri, Oct 16, 2009, 2:54 PM UTC

pmorici wrote: post #18

timf wrote: post #11

Earlier quoted context omitted.

Not my hard drive, the disk itself is fully encrypted and won't work in other laptops without that bios password (I also use a truecrypt-like thing at the filesystem level). The main attack I need to worry about is someone replacing the keyboard, etc.

What laptop / HD combination does that, or rather how can I tell if mine supports it?

Most corporate laptops support it, IBM/Leonova do. The problem is how do you know there isn't a master password (for AMI's bios it used to be "AMIBIOS") how do you know their encryption is any good (there was an enterprise tape vendor that advertised DES encryption but actually just XORed the data with your password)

And finally how do you know they haven't done exactly the same trick but replaced your bios with one that includes a keylogger?

Re: Evil Maid goes after TrueCrypt

#45

Post by mcav » Fri, Oct 16, 2009, 3:05 PM UTC

visitor4rmindia wrote: post #2

This is utterly fascinating. I use TrueCrypt and never dreamt that such a simple attack even existed. Sigh - privacy in the age of information seems to be an impossible dream.

> Sigh - privacy in the age of information seems to be an impossible dream.

Well, it's better than before: Non-electronic documents are arguably much easier to steal. At least with encryption, breaking into your house isn't necessarily enough to get your data.

Re: Evil Maid goes after TrueCrypt

#46

Post by decode » Fri, Oct 16, 2009, 3:06 PM UTC

zargon wrote: post #43

This is why your decryption boostrap should never be on the hard drive. It should be on a usb stick along with your encrypted keys. This is elementary "something you have + something you know" security. The evil maid can't patch a bootloader that isn't there. And if he installs a keylogger, he's still out of luck because he only has your passphrase, not your decryption keys. He would also have to install a device tha…

If you're assuming the attacker has physical access to your laptop, you can also assume they have access your USB stick. Even the article admits this is a problem:

"somebody who can get access to my Disk Hasher USB (e.g. when I’m in a swimming pool), can infect it"

Re: Evil Maid goes after TrueCrypt

#47

Post by aniketh » Fri, Oct 16, 2009, 3:18 PM UTC

noonespecial wrote: post #42

Whenever I suspect I might be somewhere where there's a keylogger running (public terminal etc) and I absolutely have to enter a password anyway, I just use the mouse to enter it out of order (and click away to throw in some random junk) while typing it in. Thwarts screen grabbers and keyloggers.

wouldn't that just be defeated if the form post was intercepted?

Re: Evil Maid goes after TrueCrypt

#48

Post by callahad » Fri, Oct 16, 2009, 3:34 PM UTC

It seems like the easiest poor-man's solution would be to disable booting from external devices, set a strong BIOS password, and fill the laptop's screw holes with epoxy.

At that point, you only have to worry about the strength of the BIOS's password-protection. Any other attempt at circumvention would be self-evident thanks to the destroyed case or epoxy.

Re: Evil Maid goes after TrueCrypt

#49

Post by TrevorJ » Fri, Oct 16, 2009, 3:54 PM UTC

tptacek wrote: post #32

idlewords wrote: post #9

Earlier quoted context omitted.

What is of interest here is the small window of time required. You pretty much have to be in constant possession of your laptop (or a USB key that you religiously use to verify your boot record) in order to have any confidence that it has not been compromised.

The reality is, nobody is going to physically attack your laptop (just don't bring your work machine to Black Hat). But there is an unacceptably high probability that your laptop will get stolen; for instance, you will often leave it in your car, where anyone with a cinderblock can get it in under a minute. TrueCrypt is about the guy with the cinderblock, not about stopping Joanna Rutkowska from installing a keylogge…

With the current implementation of this hack, you pretty much have to steal the machine once the passcode is sniffed out anyway.

Re: Evil Maid goes after TrueCrypt

#50

Post by zargon » Fri, Oct 16, 2009, 3:55 PM UTC

decode wrote: post #46

zargon wrote: post #43

This is why your decryption boostrap should never be on the hard drive. It should be on a usb stick along with your encrypted keys. This is elementary "something you have + something you know" security. The evil maid can't patch a bootloader that isn't there. And if he installs a keylogger, he's still out of luck because he only has your passphrase, not your decryption keys. He would also have to install a device tha…

If you're assuming the attacker has physical access to your laptop, you can also assume they have access your USB stick. Even the article admits this is a problem: "somebody who can get access to my Disk Hasher USB (e.g. when I’m in a swimming pool), can infect it"

Are we talking about maids or spies? Compared to a laptop, USB sticks are easier to keep in your wallet, lock in a safe, hide, swallow, etc. So I disagree with that assumption. A maid would need quite a lot more resources to track down both the laptop and the usb stick than the laptop alone.