| |||||||||||||
Attack of the killer iPodsAttack of the killer iPodsPosted Jun 23, 2005 3:27 UTC (Thu) by mrshiny (subscriber, #4266)Parent article: Attack of the killer iPods
So, the problem is that people can attach removable storage devices and copy data to them?
Seems to me like a simple solution would be:
Then it wouldn't matter if a thief took the whole machine, there's nothing on it and no way to get it without breaking some other, supposedly secure, component.
If an attacker can run an arbitrary program on your desktop, you are already toast.
You can also make it harder to compromise the local machine by only allowing hard-drive boots and setting a bios password. On some machines bios passwords are stored in NVRAM (IBM thinkpads) so even taking out the bios battery won't clear the password. For the truly paranoid, install case-open detecting hardware.
This is just the same old physical security problem we've always had, except that iPods can hold as much as Johnny Mnemonic now. But in the old days, copying files to floppies, or network-transferring them to another computer, or installing keyloggers... all these things are old news, really.
(Log in to post comments)
Attack of the killer iPods Posted Jun 23, 2005 9:56 UTC (Thu) by ayeomans (subscriber, #1848) [Link] Simple in Linux maybe. But LWN readers are spoiled, try doing it in Windows!
Personally I prefer a thin client approach, since if the dataset is that valuable, you never want it to appear in its entirety at the client. There are many theft routes, even a passive network sniffer will do the job. Instead, let the application run on the server, providing screen views of only the data that is authorised to be accessed. You can't easily stop the digital camera or photographic memory, so don't provide all the data in the first place. And don't forget the printer or email routes to get the data out.
Again, quite easy in Linux, but rather harder to plug all the holes in Windows.
Attack of the killer iPods Posted Jun 23, 2005 12:06 UTC (Thu) by mrshiny (subscriber, #4266) [Link] Actually, I'd say it's fairly easy to set policies in Windows to prevent users from storing data on local machines. One place where I worked tried to apply this policy to developers, who are among the few that need to use local storage and need to install softare locally. Needless to say that policy was not well received, but my point is that Windows provides the tools. As for digital cameras and email and such, those will only help if the workstation in question is logged in; since most workstations that run Windows use some flavour of NT, it's trivial to lock the workstation and require a password on login. Microsoft may not ship XP with the most secure settings out of the box, but it's easy to turn them on; much easier than trying to disable USB devices.
Attack of the killer iPods Posted Jun 27, 2005 13:05 UTC (Mon) by thompsot (guest, #12368) [Link] Agree 100%. Thin clients make more sense in more ways than I can count, and a well thought out set-up makes having light-duty-server class, power wasting, incredibly insecure, virus/spyware magnets on each desk seem ridiculous (not that it doesn't seem ridiculous already).
|
|||||||||||||