MESSAGE
| DATE | 2015-12-27 |
| FROM | Chris Knadle
|
| SUBJECT | Re: [Hangout-NYLXS] GRUB Vulnerability
|
Ruben Safir:
> On 12/26/2015 09:10 PM, Chris Knadle wrote:
>> Rick Moen:
>>> Quoting Chris Knadle (Chris.Knadle-at-coredump.us):
>>>
>>>> Thus... it's "not news" to those not running full disk encryption.
>>>
>>> It's also 'not news' to those who assume unrestricted access to the
>>> physical console and system box so approximates total absence of
>>> security as makes little diference.
>>
>> Okay -- walk me through the logic you've stated above. There's a machine in
>> front of you that is using full disk encryption including /boot and the
>> machine boots to a GRUB password prompt. Please explain how this situation
>> "approximates total absence of security".
>>
>> -- Chris
>>
>
> Umm - maybe you can pull the hard drive out and crack it at your leisure
> and boot with a different drive? think the encrypted drives saved
> Snodens data from the Russians.
>
> I know this is old fashioned of me, but how can you think you have any
> security if you don't have physical security of the device?
There's a chance we might be talking about different meanings of "security"
-- in this case I'm talking about securing the data, i.e. the contents of a
drive, using full disk encryption (in relation to GRUB).
Having physical access to the drive doesn't automatically let you crack it
open like a Piņata and get the encrypted data within -- that's exceptionally
difficult. In fact physical access of a machine that's off is one of the
"threat models" that full disk encryption is relatively good for -- say like
a laptop or a backup tape drive being taken after being accidentally left
somewhere.
Full disk encryption actually works, so if the data is decrypted the typical
way that's done is by /bypassing/ the encryption rather than brute-forcing
it -- getting the owner to give up the password, getting it via a key
logger, pulling RAM out of the machine and freezing it long enough to read
the memory and getting an input password that way, catching the owner
unawares while using the machine (like what happened with Silk Road), etc.
So this is another reason to keep in mind what your "threat model" is --
who/what you're looking to defend against.
Where this applies to GRUB: it's possible to set up GRUB so that the
password entered can be passed onto a GRUB module and decrypt the full disk
encryption so that there's just one password to enter at boot time.
Rick Moen:
> I think we are somehow miscommunicating, as I wasn't addressing the
> scenario of using full disk encryption.
Okay.
-- Chris
--
Chris Knadle
Chris.Knadle-at-coredump.us
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/
|
|
