Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evil Maid goes after TrueCrypt

theinvisiblethings.blogspot.com

Post reply on HN
Print view View original

61–67 of 67 posts

Re: Evil Maid goes after TrueCrypt

#61

Post by pyre »

blasdel wrote: post #58
idlewords wrote: post #8

Earlier quoted context omitted.

How is this a social engineering attack in any way? The point of interest here is how rapidly an encrypted laptop can be compromised by an untrained person, in a way that evades easy detection.

Because it's 'compromised' by surreptitiously convincing the user to give you the password.

That's no more social engineering than installing a hardware keylogger is. It's a technical solution. Social engineering would be convincing the user person-to-person to give up their password (as with a phone call).

Phishing scams and virus emails are social engineering in that they are conning the user into taking an action. You're not 'conning' the user into entering their password, you are just making it look like the system is normal and the user is entering their password on their own (because they are looking for access to the system). It would no more be a social engineering hack if you were to make a duplicate laptop with only a keylogger on it, and then burst into the room guns-blazing once they tried to log in with the password.

Maybe I'm off here but most social engineering has to do with convincing the user to trust 'you' where 'you' can be an unsolicited email telling them to send money to Nigeria, or a person on the phone claiming to need their password to 'reset their account.' In the case of this attack (or a keylogger), they are trusting something that they already trust, their laptop. You're not 'convincing' them to trust their laptop. You're just covering up the fact that it's been compromised.

Re: Evil Maid goes after TrueCrypt

#62

Post by pyre »

zargon wrote: post #50
decode wrote: post #46

Earlier quoted context omitted.

If you're assuming the attacker has physical access to your laptop, you can also assume they have access your USB stick. Even the article admits this is a problem: "somebody who can get access to my Disk Hasher USB (e.g. when I’m in a swimming pool), can infect it"

Are we talking about maids or spies? Compared to a laptop, USB sticks are easier to keep in your wallet, lock in a safe, hide, swallow, etc. So I disagree with that assumption. A maid would need quite a lot more resources to track down both the laptop and the usb stick than the laptop alone.

I agree. People are still thinking of 'USB Sticks' as the actual pen drives out there. Think of how small microSD cards are. There are USB microSD readers that barely the size of the USB connector itself. That's so small it's scary... and take the actual microSD card out of the reader and it's even smaller. I could probably hold it in the side of my mouth while swimming in the pool if I was really paranoid.

Re: Evil Maid goes after TrueCrypt

#63

Post by timf »

pyre wrote: post #61
blasdel wrote: post #58

Earlier quoted context omitted.

Because it's 'compromised' by surreptitiously convincing the user to give you the password.

That's no more social engineering than installing a hardware keylogger is. It's a technical solution. Social engineering would be convincing the user person-to-person to give up their password (as with a phone call). Phishing scams and virus emails are social engineering in that they are conning the user into taking an action. You're not 'conning' the user into entering their password, you are just making it look lik…

You seem to want to limit the definition of social engineering to actually coming into social contact with the password-giver.

The victim trusts the hotel, the social engineering I saw here is getting into the position of being a maid (who is trusted to not mess with your stuff (well, not by me but apparently by some)). Just like you can social engineer yourself into any company in order to get at the machines and install a keylogger.

In my original statement I did not do a very good job at how I am dismissing the interestingness of the original blog post, but a keylogger insertion (either software or hardware based) is a time tested technique,there is nothing new here with the attack "payload."

So all I see is "how did the attacker get physical access" but did not flesh this viewpoint out at all, and I apologize.

Think of it in terms of remote exploits and their payloads. Why discuss the subtle differences between rootkit #1 vs. rootkit #2 and how each will screw you: the problem is actually in the attack vector, not the payload. Once you're in, the details are somewhat boring (relatively speaking).

Re: Evil Maid goes after TrueCrypt

#64

Post by CaptainMorgan »

chanux wrote: post #20

Am I the only one who feel that trucrypt dev is just running away from answer here. Joanna Rutkowska: If I could arrange for a proper lock or an impenetrable strongbox, than why in the world should I need encryption? TrueCrypt Developer: Your question was: "And how can you determine that the attacker has or has not worked with your hardware?" My answer was a good safety case or strongbox with a good lock. If you use…

The way I understand it and correct me if I'm wrong, but as shin_lao pointed out above: "Full drive encryption is meant to protect against theft or loss, not against trojan horses (be that hardware or software)."

This is a good point with regard to the Maid scenario, so I don't think the developers of TC were running away from the question at all.

And from the article: "After some 1-2 minutes, the target's laptop gets infected with Evil Maid Sniffer that will record the disk encryption passphrase when the user enters it next time." -- so the attacker is depending on the user reentering the system, and they are depending on confiscating the system afterwards. Loss and theft scenarios where an attacker has not utilized EMS, or is just out to steal the laptop, still protects the data.

So in summation, you need encryption to protect against loss or theft, which may be sufficient for your vulnerability level (maybe you don't travel a lot but one day you simply lost your laptop), but you need to go further to protect against what looks to me to be a more advanced version of a keylogger (EMS - frequent traveler with sensitive information).

Re: Evil Maid goes after TrueCrypt

#65

Post by mhansen »

antirez wrote: post #22
chanux wrote: post #20

Am I the only one who feel that trucrypt dev is just running away from answer here. Joanna Rutkowska: If I could arrange for a proper lock or an impenetrable strongbox, than why in the world should I need encryption? TrueCrypt Developer: Your question was: "And how can you determine that the attacker has or has not worked with your hardware?" My answer was a good safety case or strongbox with a good lock. If you use…

I don't think so. If the attacker got physical access to the hardware there is very little you can do via software, given the architecture of normal computers. So the only thing that makes sense is to find a way to detect physical access, and currently the only one is to physically protect the computer itself. Edit: still there are a few tricks that can be done in theory. For instance to flash a new bios modified in…

I remember coming across machines with BIOS passwords... I'd groan as I realized I had to open up the computer, and remove the little battery to reset the password. Took a few minutes.

Re: Evil Maid goes after TrueCrypt

#66

Post by vincent_vega »

timf wrote: post #55
cellis wrote: post #24

Earlier quoted context omitted.

Just keep it in a lock case. This solves the problem of Evil Maids, but not of Evil Maids-financed-by-the-NSA-with-lockpickers. I have to imagine that if those types of people were after your encrypted info,you'd know and you'd probably keep it handcuffed to your wrist.

I usually just keep my data on a USB key and then buy a brand new laptop from a random store every time I want to access it.

Oh rly?

Re: Evil Maid goes after TrueCrypt

#67

Post by fnid »

Evil maid is modifying the boot record with a hook to their own code. If the boot record where this function is located is hashed and verified at the next boot, couldn't truecrypt alert the user to the compromise?
Post reply on HN