51–60 of 195 posts
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?
In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe…
https://www.schneier.com/blog/archives/2007/10/uk_police_can...
Not sure what the situation is now.
Seems like a lot of code for what should be, on Linux anyway, a simple udev rule? echo 'RUN+=/root/usb-changed.sh' > /etc/udev/rules.d/usb-changed.rules Then just put whatever you want to be ran in /root/usb-changed.sh.
I think you would at least add an allowlist of safe (i.e. owned by you) USB ids you don't want to shut your pc/laptop down if connected
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
Here's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/ If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal. //Small edit to wording
Earlier quoted context omitted.
In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe…
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
+ The person being given the notice has the key
+ Investigators need the key to prevent or detect crime
+ Disclosure is proportionate
+ They can't get the encrypted material by other means
Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years.
There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-...
I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices.
For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers.
EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
Earlier quoted context omitted.
In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe…
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
Earlier quoted context omitted.
Here's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/ If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal. //Small edit to wording
Does anyone have pointers as to whether this is even possible with DDR4 on modern machines?
"In recent years, however, it has become increasingly challenging to execute cold boot attacks or perform physical memory forensics due to the introduction of DRAM memory scramblers. Modern processors with DDR3 and DDR4 DRAM scramble data by XOR’ing it with a pseudorandom number before writing it to DRAM [5], [6]. These scramblers were initially introduced to mitigate the effects excessive current fluctuations on bus lines by ensuring bits on the memory bus transition nearly 50% of the time"
DDR4 is also yes in the lab -
https://web.eecs.umich.edu/~misiker/resources/HPCA17-coldboo...
I like this wording.
Disclaimer: Not a comment on current political happenings.
But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.
Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?
In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe…
> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.