4 ms·
Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow. On
by eat_veggies 9y ago
Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow.
On most Linux setups, that system is the initramfs--if you've ever installed Arch or similar, this is what the `mkinitcpio` step generates--and if you peek in your boot partition, it'll probably be named something like `initramfs-linux.img`.
The initramfs is a (often gzip compressed) ramdisk image for a full-blown tiny Linux system, complete with its own set of coreutils (if you want to see what it contains, run `lsinitcpio -x` on it). It's what handles your boot process, like setting up your keymaps, mounting disks, and of course, decrypting encrypted partitions.
By unpacking, modifying, and repacking the initramfs, it's possible--even trivial--to run whatever code you want as root, or intercept the user's encryption password when they type it in to do the type of conventional unencrypted backdooring you have in mind.
- mirimir 9y agoTrue. But after doing a standard LUKS install, you can move /boot to an SD card. You can also backup the LUKS header to the SD card, and wipe it from the system. Now the machine cannot be booted without the SD card. After restoring the LUKS header. And even if an adversary creates a new /boot on the machine, you can check for that, and nuke it before booting from the SD card. If you're detained, you can just chew up the SD card and swallow it. Maybe a little hard on the teeth, but hey. But of course, that SD card must never leave your body. Except that you probably want to hide copies somewhere. In case you lose it, or whatever.
- PuffinBlue 9y agoSo put malware in the BIOS itself, or one of the other chips or ROMs available. I think I remember reading a story recently about Thunderbolt or maybe USB being connected to an Option ROM over PCIe (must have been Thunderbolt I guess) that allowed an attacker to simply plug in a USB stick and permanently and irrevocably pwn the system - right down to securing the flaw that allowed flashing of the ROM over the PCIe connection. I think the malware overwrote some bit that allowed any further writing, so even attaching physical chip flashing device to the ROM wouldn't clear the malware. The machine was effectively permanently compromised and could only be thrown away.
- mirimir 8y agoYes, it was Thunderbolt.[0] Firewire had the same issue. As does PCIe. But maybe USB 2.0 can be secured. If so, just fill other ports with epoxy. And use metal-flake nail polish to tamper protect seams. If USB isn't securable, give up, I guess. 0) https://news.ycombinator.com/item?id=12383130 https://news.ycombinator.com/item?id=12383130
- georgebarnett 8y agoThat’s the great thing about USB-C - If you epoxy the ports, you now can’t charge.. sigh
- mirimir 8y agoMaybe have multiple batteries, and use a dumb charger?
- georgebarnett 8y agoMy MacBook has only one port and a sealed battery compartment, which is not helping :(
- mirimir 8y agoDamn. So is USB-C securable?
- georgebarnett 8y agoSure!* *Probably not, going by history.
- mirimir 8y agoSo how come there's no key-authenticated USB? Something analogous to OpenSSH, maybe.