5 ms·

I remember many years ago, as I was thinking about going into technology as a career, I was chatting with a family friend who worked in computer security. I was

by mabbo 6y ago

I remember many years ago, as I was thinking about going into technology as a career, I was chatting with a family friend who worked in computer security. I was asking him what he did. He said "If I have physical access to a computer, it's almost certain I will be able to get whatever data is on it. Especially if it's still running and logged in." (or something to that effect). Stuff like this always reminds me of that guy (haven't seen him in decades, sadly). Oh, you used AES encryption? That's lovely, but your computer knows the key and I can trick it into telling me it. Truecrypt likely changed the game on some of the claims he made, but that conversations predated it's existence. Today the angle of attack seems to be around OTP + Password with a timeout on the credentials generated. It narrows the window, but doesn't completely block it.

dtech 6y ago
Truecrypt doesn't change that if the user has the volume open. When computers still had Firewire if they had a warrant for child porn they would use FW and DMA to pull a complete copy of the memory if it was on and get any encryption keys to the Truecrypt volume. They would actually announce that they were coming in on suspicion of child porn because people had a tendency to boot the computer and open Truecrypt to delete all their files. I suspect similar techniques are still used today, like we see with this tool. If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware.
- Drip33 6y ago
  >If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware What methods are available to get a memory dump if Firewire is disabled? Feds couldn't break my encryption after ~1.5 years but my devices were all off when they showed up. Ironically the one device they did get into was a cell phone powered on but it had little evidentiary value and in one funny way was partly exculpatory.
  - dtech 6y ago
    USB-C+Thunderbolt or eSATA with a vulnerable controller. I know modern OSes have protection against driveby-DMA, but don't know if they protect against memory dump if the "user" - or attacker who gained access to a logged in system - consents. All these attacks target decryption keys in memory, so they don't work on devices which are turned off.
    - Drip33 6y ago
      I'm assuming the computer is "locked" but online, and no users consent to logging in to run anything. Will any of these methods still work if Firewire drivers are disabled?
      - wongarsu 6y ago
        In that case USB-C/Thunderbolt won't work, in the default config you need to trust the device and cable before anything too interesting can happen. This can be turned off via bios setting though, so there's room for misconfiguration. E-SATA or PCIe hotplug might still work. However the former is getting less common, and the latter is uncommon in consumer mainboards.
        ra 6y ago
        Thunderbolt in some cases: https://thunderspy.io/ https://thunderspy.io/
  - koolba 6y ago
    You can freeze the computer, remove the DIMMs, and then pop them into a different machine to read them: https://electronics.stackexchange.com/questions/32189/freezing-dram-for-forensics-coldboot https://electronics.stackexchange.com/questions/32189/freezi...
    - Drip33 6y ago
      I thought that wasn't possible since DDR3 or 4?
- srtjstjsj 6y ago
  It seems unlikely that (a) FBI understood truecrypt (b) the target understood truecrypt (c) the target misunderstood the entire purpose of truecrypt, and they would misuse it to expose themselves and (d) the FBI expected this and intentionally blew their cover, leaving the target a chance to destroy the drive.
  - enedil 6y ago
    It's likely though that they knew that AES keys are somewhere in the memory.
- rojaz 6y ago
  Why did having FireWire matter?
  - ra 6y ago
    Because FireWire has direct memory access (DMA). See https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack
hinkley 6y ago
I had a brief moment of technological joy when I worked at a place that had strict rules about leaving your computer unlocked, which I always struggled with. I had this new Symbian phone with Bluetooth (2?) and there was an app you could get for OS X that would lock your machine when it lost BT signal. Sub in a larger battery (still one of my favorite mini hacks, removing a little plastic so the 30% bigger Ngage battery would fit) and I was good to go, until the app stopped working. Big part of why I bought an Apple Watch (and then keep forgetting to set it up)
- mabbo 6y ago
  I worked in a place in 2006 where my username was a badge and my password was my fingerprint. The badge had to be inserted into a reader for the computer to be unlocked. It was also attached (via a badge holder) to the RFID badge needed to open any locked doors. This meant that to get to and go to the washroom, I had to take my badge out, which locked the computer. It was a very neat and secure system.

by mabbo 6y ago

dtech 6y ago

Truecrypt doesn't change that if the user has the volume open. When computers still had Firewire if they had a warrant for child porn they would use FW and DMA to pull a complete copy of the memory if it was on and get any encryption keys to the Truecrypt volume. They would actually announce that they were coming in on suspicion of child porn because people had a tendency to boot the computer and open Truecrypt to delete all their files. I suspect similar techniques are still used today, like we see with this tool. If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware.

Drip33 6y ago
>If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware What methods are available to get a memory dump if Firewire is disabled? Feds couldn't break my encryption after ~1.5 years but my devices were all off when they showed up. Ironically the one device they did get into was a cell phone powered on but it had little evidentiary value and in one funny way was partly exculpatory.
- dtech 6y ago
  USB-C+Thunderbolt or eSATA with a vulnerable controller. I know modern OSes have protection against driveby-DMA, but don't know if they protect against memory dump if the "user" - or attacker who gained access to a logged in system - consents. All these attacks target decryption keys in memory, so they don't work on devices which are turned off.
  - Drip33 6y ago
    I'm assuming the computer is "locked" but online, and no users consent to logging in to run anything. Will any of these methods still work if Firewire drivers are disabled?
    - wongarsu 6y ago
      In that case USB-C/Thunderbolt won't work, in the default config you need to trust the device and cable before anything too interesting can happen. This can be turned off via bios setting though, so there's room for misconfiguration. E-SATA or PCIe hotplug might still work. However the former is getting less common, and the latter is uncommon in consumer mainboards.
      - ra 6y ago
        Thunderbolt in some cases: https://thunderspy.io/ https://thunderspy.io/
- koolba 6y ago
  You can freeze the computer, remove the DIMMs, and then pop them into a different machine to read them: https://electronics.stackexchange.com/questions/32189/freezing-dram-for-forensics-coldboot https://electronics.stackexchange.com/questions/32189/freezi...
  - Drip33 6y ago
    I thought that wasn't possible since DDR3 or 4?
srtjstjsj 6y ago
It seems unlikely that (a) FBI understood truecrypt (b) the target understood truecrypt (c) the target misunderstood the entire purpose of truecrypt, and they would misuse it to expose themselves and (d) the FBI expected this and intentionally blew their cover, leaving the target a chance to destroy the drive.
- enedil 6y ago
  It's likely though that they knew that AES keys are somewhere in the memory.
rojaz 6y ago
Why did having FireWire matter?
- ra 6y ago
  Because FireWire has direct memory access (DMA). See https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack

hinkley 6y ago

I had a brief moment of technological joy when I worked at a place that had strict rules about leaving your computer unlocked, which I always struggled with. I had this new Symbian phone with Bluetooth (2?) and there was an app you could get for OS X that would lock your machine when it lost BT signal. Sub in a larger battery (still one of my favorite mini hacks, removing a little plastic so the 30% bigger Ngage battery would fit) and I was good to go, until the app stopped working. Big part of why I bought an Apple Watch (and then keep forgetting to set it up)

mabbo 6y ago
I worked in a place in 2006 where my username was a badge and my password was my fingerprint. The badge had to be inserted into a reader for the computer to be unlocked. It was also attached (via a badge holder) to the RFID badge needed to open any locked doors. This meant that to get to and go to the washroom, I had to take my badge out, which locked the computer. It was a very neat and secure system.