Authenticated Boot and Disk Encryption on Linux • Hacker News Board

Re: Authenticated Boot and Disk Encryption on Linux

#211

Post by uuidgen » Tue, Sep 28, 2021, 11:24 PM UTC

rcthompson wrote: post #67

uuidgen wrote: post #55

Earlier quoted context omitted.

> Copy the login screen of original laptop on a brand new laptop, and have it log the password when the victim types it to you over wifi. This is why you need mutual authentication. The easiest is with 2 passwords. You enter a password, this authenticates you to the system. Now system presents you some secret. It may be a passphrase, something not obvious like a password prompt with a typo, or a splash screen with so…

If someone is considering an "evil maid" style attack, the objective is to compromise your security without you knowing (so that you will continue using the device believing it is still secure). "Asking nicely" isn't going to accomplish that.

What for? You want to gain access to some data or lear something or get access to one of my clients.

"Asking nicely" is how intelligence/counter-intelligence recruits their assets - some are bought some are forced.

Re: Authenticated Boot and Disk Encryption on Linux

#212

Post by helpm33 » Wed, Sep 29, 2021, 4:39 PM UTC

temac wrote: post #196

kobalsky wrote: post #136

Earlier quoted context omitted.

> If your attacker is both sophisticated and able to access your hardware directly, the game is over; nothing we can do can currently avoid this. I think with blanket statements like this it's important to define sophisticated. For example, what kind of resources are required to break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* ? I'm of course not talking about social engine…

> break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* On Windows (even modern versions IIRC) you can sniff the traffic (or maybe forge requests? I think it was simply sniffing though) to the TPM and get the keys to decrypt the HD, if there is no additional protection (like a PIN or password). Don't know if this is also applicable to Linux stacks. Kind of weird the interface ha…

FWIW, TPM 2.0 can encrypt the TPM traffic, so the attack by physically sniffing the TPM (https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in...) is no longer possible.

Re: Authenticated Boot and Disk Encryption on Linux

#213

Post by hyproxia » Thu, Sep 30, 2021, 7:54 PM UTC

phh wrote: post #32

Every time I read stuff about secure boot, "evil maid" attack scenarios come up. And every time, they fail to mention the easiest one. The attack described here involves dismantling the victim's hard drive. I have an attack that isn't defeated by secure boot, and doesn't even require dismantling anything. Steal the original laptop. Take another physically identical unit. Replace it. Copy the login screen of original…

Hello, I'm curious, do you happen to be the person behind "phh's SuperUser?"

Re: Authenticated Boot and Disk Encryption on Linux

#214

Post by temac » Wed, Oct 06, 2021, 9:14 PM UTC

helpm33 wrote: post #212

temac wrote: post #196

Earlier quoted context omitted.

> break the disk encryption of a computer protected with tpm 2.0 + secureboot + luks w/tresor* On Windows (even modern versions IIRC) you can sniff the traffic (or maybe forge requests? I think it was simply sniffing though) to the TPM and get the keys to decrypt the HD, if there is no additional protection (like a PIN or password). Don't know if this is also applicable to Linux stacks. Kind of weird the interface ha…

FWIW, TPM 2.0 can encrypt the TPM traffic, so the attack by physically sniffing the TPM ( https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-in... ) is no longer possible.

It can but from the article, with a not so old Windows stack it seems that this encryption is not used:

> At the time of this writing BitLocker does not utilize any encrypted communication features of the TPM 2.0 standard, which means any data coming out of the TPM is coming out in plaintext, including the decryption key for Windows. If we can grab that key, we should be able to decrypt the drive, get access to the VPN client config, and maybe get access to the internal network.