"Evil Maid" attack against disk encryption
Posted Oct 29, 2009 15:00 UTC (Thu) by drag
In reply to: "Evil Maid" attack against disk encryption
Parent article: "Evil Maid" attack against disk encryption
If a normal PC was left on then it makes it even easier to grab passwords.
If your using a laptop, for example, any device that you plug into it that
implements DMA access can trivially retrieve your password. Like a firewire
cardbus card or something like that. Plug that in, Linux detects it and
configures it, and the attacker uses a separate PC running Linux to
communicate over the firewire and send DMA requests to systematically shift
through your memory until it finds the encryption key.
Even if you block against autodetecting hardware your RAM is still
removable so that if the attacker is quick they can pull your RAM out of
your machine and then read it before the memory goes all random on them.
And there are other attacks besides that.
Now this is with actual hardware you can actually buy. Theoretically if
you have some sort of physical resistant hardware then that may help. For
example you can currently purchase hardddrives that have self-destruct
mechanisms that get set off if they are tampered with... doing such things
as spraying the drive internals with acid mist to etch the platters. So you
can do all sorts of stuff theoretically if the hardware supports it, but
right now that is not typical consumer hardware most of us can afford.
Now I can't believe people are avoiding obvious solutions to this
particular attack (were they install a trojaned bootloader):
TAKE YOUR BOOTLOADER WITH YOU.
This is Linux. You don't have to boot off of internal media if you don't
want to. Use a USB stick and boot from that and take that with you.
Or just take the laptop with you were ever you go. If it is a small device
like a "open Linux smartphone" or a netbook that can adequately meet your
needs then you can just keep it on your person.
to post comments)