5 ms·

> As a general rule, anyone with physical access to your machine already owns it. People frequently say this, but never really explain it. As far as I can tell

by mjg59 6y ago

> As a general rule, anyone with physical access to your machine already owns it. People frequently say this, but never really explain it. As far as I can tell, it translates to "Nobody cares about physical security" - except it's clear that people /do/. Things like Boot Guard are only really relevant to physical attacks. DMA protection in firmware is only really relevant to physical attacks. It's extremely obvious that the industry is attempting to avoid short term physical access to a device being sufficient to compromise it, and research that demonstrates that it's still possible is valuable.

zinodaur 6y ago
An example: Macbook chargers these days have charge ports that are also used for USB devices. This means that if a user plugs in a compromised "charger", it can set its own HID type (and pretend it is a keyboard or a mouse), open a terminal and start typing malware into the computer. All of this is a bit silly though, because physical intervention implies a level of commitment that lends itself to more reliable approaches: https://xkcd.com/538/ https://xkcd.com/538/
- mjg59 6y ago
  And a thing you can do for machines that have built-in keyboards is refuse to enable new HID devices until the user provides affirmative consent. The people who have reason to care about these attacks have defenses, and research that demonstrates those defenses are incomplete is useful research.
  - zinodaur 6y ago
    Yeah thats a good point - I personally have the bad habit of clicking "yes" to that dialogue whenever I see it, since it does sometimes spuriously appear. I certainly wouldn't attempt a teardown of all of the equipment currently plugged into my machine when I saw a message like that. Do you know if HIDs can impersonate other HIDs? E.g., if you attached a dongle to a usb keyboard, could that dongle claim the identity of the keyboard and thereby avoid the prompt? My favorite "security interface failure" is the fact that OSX apps frequently demand a user login and password in a popup window. E.g., Slack does this. It would be so easy for an app render this popup (even on a webpage!) and I would totally type my password into it. I feel like the only answer to this is to have a sacred corner of the screen that only the OS is allowed to write to
    - erik_seaberg 6y ago
      This is why NT had a "secure attention key" (ctrl-alt-del) that couldn't be intercepted by an app that might try to display a fake login screen.
Spooky23 6y ago
There are huge swaths of people who don’t think about physical security at all. But many do and it’s a difficult problem that impacts the efficiency of the business. I’ve had to deal with it often and end of the day, you need to keep important data off of mobile or other client devices, and have controlled workarounds for exceptions. Some of the tougher compliance standards recognize this and essentially prohibit many types of remote access without the entity owning the remote computer.
excalibur 6y ago
The point of the saying is that, try as we might to secure the devices, they can be compromised by someone with physical access (and the right knowledge and tools) in essentially all cases. It is not meant to discourage you from using the best security measures available ON the device, but rather to point out that the only way to truly have physical security is to maintain control OF the device.
ashtonkem 6y ago
These are mitigations, they’re designed to slow down an attack by someone who has physical access to the machine. In many ways they’re a bit like a finely designed padlock; none are ever going to stop a skilled lock pick, but they can slow them down enough to make an attach impractical.
maxbond 6y ago
Physical access is just such a rich attack surface that keeping your computer away from malicious actors is the right and proper solution. An extreme example a pentester imparted to me once was, if someone could spend sufficient time alone with my laptop, they could remove my hard drive and insert it into an identical laptop with a hardware or firmware backdoor preinstalled. We were discussing nation-state adversaries, but the general principle applies. Another example is attacks on encrypted drives (so-called "evil maid" attacks). If a computer is booted and the drive is decrypted, an attacker with physical access could open the computer, remove the RAM, and download it's contents, thereby stealing the encryption key. If the computer is powered down, it's still vulnerable to other attacks; enrypted drives necessarily have cleartext code for accepting the password & decrypting the drive. You could modify this code to log the decryption key, or broadcast it over your device's radios. There's also the classic Windows "sticky key" exploit, where you replace the sticky key binary with a program that gives you administrator access, reboot the computer, and then activate sticky keys. You could install a keystroke logger. You could install a device to record monitor output. You could log network traffic. I've yet to find a kiosk environment that I couldn't break out of. Once I was able to break out of a scanning kiosk environment, and into a Windows desktop, by turning the quality settings all the way up and crashing the kiosk. That was one of the more difficult examples; most of the time all you need is to find a way to right-click. (I had the proper authority to investigate these kiosks.) The point is that the list goes on. It is true, as you say, that there has been progress in implementing mitigations, and that there are people who care deeply about these issues. A counterexample might be SIM cards, TPMs, and other HSMs. These systems are able to provide better guarantees by encapsulating their peripherals and being willing to self destruct. But that could describe a cell phone, tablet a laptop, too. Maybe in the future this "law" won't be so hard and fast.
- ryan-c 6y ago
  > they could remove my hard drive and insert it into an identical laptop Does that make having a layer of stickers on one's laptop also a layer of defense?
  - AnthonyMouse 6y ago
AnthonyMouse 6y ago
> DMA protection in firmware is only really relevant to physical attacks. That's a different kind of attack than what people usually mean by "physical access" though. The thing where they drop a bunch of malicious flash drives in the parking lot or put a malicious USB charger in an airport isn't the same thing as the attacker having unsupervised physical access to the machine, and the former is certainly worth defending against even if the latter is hopeless. > Things like Boot Guard are only really relevant to physical attacks. One could argue that they are also relevant to purposely locking the device owner into specific operating systems. As an example of "physical access and you're screwed," one way to compromise a machine is to install a microphone anywhere near the machine and then wait for the user to type their passphrase. It's possible to deduce what keys are being pressed from the sounds they make and the timing, so now the attacker has your passphrase. The same can be done with covert video surveillance. Another possibility is to measure electromagnetic emissions to much the same effect. Most computer keyboards are not exactly TEMPEST certified and even if they were, someone with physical access could make adverse modifications. Protecting a machine against unsophisticated attackers is pretty easy, to the point that the likes of Boot Guard are not even required, but protecting a machine against physical access by a sophisticated attacker is pretty hopeless.
munchbunny 6y ago
It's not that nobody cares about physical security, it's that physical access opens up entire classes of attacks that aren't possible otherwise, like physical keyloggers and bridging airgaps. If you follow defense in depth as a security architecture philosophy, which the industry does, then you still implement defenses against physical attacks, but you recognize that those defenses are either (1) defenses against opportunists, or (2) last ditch defenses.

by mjg59 6y ago

zinodaur 6y ago

An example: Macbook chargers these days have charge ports that are also used for USB devices. This means that if a user plugs in a compromised "charger", it can set its own HID type (and pretend it is a keyboard or a mouse), open a terminal and start typing malware into the computer. All of this is a bit silly though, because physical intervention implies a level of commitment that lends itself to more reliable approaches: https://xkcd.com/538/ https://xkcd.com/538/

mjg59 6y ago
And a thing you can do for machines that have built-in keyboards is refuse to enable new HID devices until the user provides affirmative consent. The people who have reason to care about these attacks have defenses, and research that demonstrates those defenses are incomplete is useful research.
- zinodaur 6y ago
  Yeah thats a good point - I personally have the bad habit of clicking "yes" to that dialogue whenever I see it, since it does sometimes spuriously appear. I certainly wouldn't attempt a teardown of all of the equipment currently plugged into my machine when I saw a message like that. Do you know if HIDs can impersonate other HIDs? E.g., if you attached a dongle to a usb keyboard, could that dongle claim the identity of the keyboard and thereby avoid the prompt? My favorite "security interface failure" is the fact that OSX apps frequently demand a user login and password in a popup window. E.g., Slack does this. It would be so easy for an app render this popup (even on a webpage!) and I would totally type my password into it. I feel like the only answer to this is to have a sacred corner of the screen that only the OS is allowed to write to
  - erik_seaberg 6y ago
    This is why NT had a "secure attention key" (ctrl-alt-del) that couldn't be intercepted by an app that might try to display a fake login screen.

Spooky23 6y ago

There are huge swaths of people who don’t think about physical security at all. But many do and it’s a difficult problem that impacts the efficiency of the business. I’ve had to deal with it often and end of the day, you need to keep important data off of mobile or other client devices, and have controlled workarounds for exceptions. Some of the tougher compliance standards recognize this and essentially prohibit many types of remote access without the entity owning the remote computer.

excalibur 6y ago

The point of the saying is that, try as we might to secure the devices, they can be compromised by someone with physical access (and the right knowledge and tools) in essentially all cases. It is not meant to discourage you from using the best security measures available ON the device, but rather to point out that the only way to truly have physical security is to maintain control OF the device.

ashtonkem 6y ago

These are mitigations, they’re designed to slow down an attack by someone who has physical access to the machine. In many ways they’re a bit like a finely designed padlock; none are ever going to stop a skilled lock pick, but they can slow them down enough to make an attach impractical.

maxbond 6y ago

Physical access is just such a rich attack surface that keeping your computer away from malicious actors is the right and proper solution. An extreme example a pentester imparted to me once was, if someone could spend sufficient time alone with my laptop, they could remove my hard drive and insert it into an identical laptop with a hardware or firmware backdoor preinstalled. We were discussing nation-state adversaries, but the general principle applies. Another example is attacks on encrypted drives (so-called "evil maid" attacks). If a computer is booted and the drive is decrypted, an attacker with physical access could open the computer, remove the RAM, and download it's contents, thereby stealing the encryption key. If the computer is powered down, it's still vulnerable to other attacks; enrypted drives necessarily have cleartext code for accepting the password & decrypting the drive. You could modify this code to log the decryption key, or broadcast it over your device's radios. There's also the classic Windows "sticky key" exploit, where you replace the sticky key binary with a program that gives you administrator access, reboot the computer, and then activate sticky keys. You could install a keystroke logger. You could install a device to record monitor output. You could log network traffic. I've yet to find a kiosk environment that I couldn't break out of. Once I was able to break out of a scanning kiosk environment, and into a Windows desktop, by turning the quality settings all the way up and crashing the kiosk. That was one of the more difficult examples; most of the time all you need is to find a way to right-click. (I had the proper authority to investigate these kiosks.) The point is that the list goes on. It is true, as you say, that there has been progress in implementing mitigations, and that there are people who care deeply about these issues. A counterexample might be SIM cards, TPMs, and other HSMs. These systems are able to provide better guarantees by encapsulating their peripherals and being willing to self destruct. But that could describe a cell phone, tablet a laptop, too. Maybe in the future this "law" won't be so hard and fast.

ryan-c 6y ago
> they could remove my hard drive and insert it into an identical laptop Does that make having a layer of stickers on one's laptop also a layer of defense?
- AnthonyMouse 6y ago

AnthonyMouse 6y ago

> DMA protection in firmware is only really relevant to physical attacks. That's a different kind of attack than what people usually mean by "physical access" though. The thing where they drop a bunch of malicious flash drives in the parking lot or put a malicious USB charger in an airport isn't the same thing as the attacker having unsupervised physical access to the machine, and the former is certainly worth defending against even if the latter is hopeless. > Things like Boot Guard are only really relevant to physical attacks. One could argue that they are also relevant to purposely locking the device owner into specific operating systems. As an example of "physical access and you're screwed," one way to compromise a machine is to install a microphone anywhere near the machine and then wait for the user to type their passphrase. It's possible to deduce what keys are being pressed from the sounds they make and the timing, so now the attacker has your passphrase. The same can be done with covert video surveillance. Another possibility is to measure electromagnetic emissions to much the same effect. Most computer keyboards are not exactly TEMPEST certified and even if they were, someone with physical access could make adverse modifications. Protecting a machine against unsophisticated attackers is pretty easy, to the point that the likes of Boot Guard are not even required, but protecting a machine against physical access by a sophisticated attacker is pretty hopeless.

munchbunny 6y ago

It's not that nobody cares about physical security, it's that physical access opens up entire classes of attacks that aren't possible otherwise, like physical keyloggers and bridging airgaps. If you follow defense in depth as a security architecture philosophy, which the industry does, then you still implement defenses against physical attacks, but you recognize that those defenses are either (1) defenses against opportunists, or (2) last ditch defenses.