5 ms·

Without taking anything away from this, as a general rule, if you have physical access to the machine, it can almost definitely be compromised. The flaw here i

Without taking anything away from this, as a general rule, if you have physical access to the machine, it can almost definitely be compromised. The flaw here involves access to the GUI, which in most cases implies that they have physical access. (and in most cases would imply it is "their" machine in any event)

aftbit 6y ago
Generally agreed. This specific issue seems most likely to be a problem in a computer lab environment, where you'd likely be detected if you tried to take the case off the machine, but might be able to get away with anything that looks like normal computer use behavior.
woofie11 6y ago
No. That's not a general rule. Many universities have computer labs. The computers are in a locked cabinet, with a keyboard, mouse, and monitor exposed. For that matter, many shopping malls have information kiosks, retail stores have demo laptops, banks have ATM machines, airlines have automatic check-ins, etc. If you're typing away, no one will care. If you're opening up the device with a crowbar, or even screw driver, you'd better have a nice orange high-viz uniform, lanyard, and clipboard. Without those, security will drag you awat.
- exabrial 6y ago
  I'm not sure if you were trying to prove his point, but you did
  - woofie11 6y ago
    I'm pretty sure I know what constitutes a proof, and that wasn't it. The core reason this did not constitute a proof is because physical security people misapply lessons from that domain to digital, and software engineers misapply lessons from digital to physical. In the virtual world, I'm open to 7 billion potential attackers. In the physical world, I'm open to a few. That leads to very different security practices. If I leave my front door unlocked for a week, the security risk is minimal where I live. Casual security is good enough. If I leave my computer with even a pretty obscure vulnerability connected to the internet for 5 minutes, odds are pretty good it will be compromised. Clipboards+lanyard+high viz vest is imperfect security (and I chose the example deliberately to illustrate that), but it is good enough security to practically prevent physical compromises in most instances. I won't run a military base that way, or a HIPAA-compliant data system, but it's good enough for 95% of uses, including, for example, a university physics department's research data system. Even a military base doesn't have perfect security; a well-resourced attacker can compromise it. In contrast, in the virtual world, I want cryptographic protocols where I can prove perfect security, at least given a relatively small set of assumptions.
- nexuist 6y ago
  As we all know, high-viz uniforms, lanyards, and clipboards have historically been extremely hard to procure and outside the reach of the average person
- jlgaddis 6y ago
  > > ... if you have physical access to the machine ... > The computers are in a locked cabinet, ... Or, in other words, no physical access?
  - woofie11 6y ago
    No. In other words, controlled or monitored physical access. If I have access to a keyboard connected to CPU, that's a form of "physical access." IO devices are part of the computer.
angry_octet 6y ago
There are many remote access systems: KVM extenders over cables, IP, PCoIP, virtual desktops, Xwindows etc. The problem is the mixture of responsibilities in GDM. Someone decided to use its root permissions for a purpose unrelated to display management.
stjohnswarts 6y ago
That used to be kind of true, but if you're using encrypted filesystems and such it becomes much harder, at least for your average hacker/criminal to get something useful off the system.

aftbit 6y ago

Generally agreed. This specific issue seems most likely to be a problem in a computer lab environment, where you'd likely be detected if you tried to take the case off the machine, but might be able to get away with anything that looks like normal computer use behavior.

woofie11 6y ago

No. That's not a general rule. Many universities have computer labs. The computers are in a locked cabinet, with a keyboard, mouse, and monitor exposed. For that matter, many shopping malls have information kiosks, retail stores have demo laptops, banks have ATM machines, airlines have automatic check-ins, etc. If you're typing away, no one will care. If you're opening up the device with a crowbar, or even screw driver, you'd better have a nice orange high-viz uniform, lanyard, and clipboard. Without those, security will drag you awat.

exabrial 6y ago
I'm not sure if you were trying to prove his point, but you did
- woofie11 6y ago
  I'm pretty sure I know what constitutes a proof, and that wasn't it. The core reason this did not constitute a proof is because physical security people misapply lessons from that domain to digital, and software engineers misapply lessons from digital to physical. In the virtual world, I'm open to 7 billion potential attackers. In the physical world, I'm open to a few. That leads to very different security practices. If I leave my front door unlocked for a week, the security risk is minimal where I live. Casual security is good enough. If I leave my computer with even a pretty obscure vulnerability connected to the internet for 5 minutes, odds are pretty good it will be compromised. Clipboards+lanyard+high viz vest is imperfect security (and I chose the example deliberately to illustrate that), but it is good enough security to practically prevent physical compromises in most instances. I won't run a military base that way, or a HIPAA-compliant data system, but it's good enough for 95% of uses, including, for example, a university physics department's research data system. Even a military base doesn't have perfect security; a well-resourced attacker can compromise it. In contrast, in the virtual world, I want cryptographic protocols where I can prove perfect security, at least given a relatively small set of assumptions.
nexuist 6y ago
As we all know, high-viz uniforms, lanyards, and clipboards have historically been extremely hard to procure and outside the reach of the average person
jlgaddis 6y ago
> > ... if you have physical access to the machine ... > The computers are in a locked cabinet, ... Or, in other words, no physical access?
- woofie11 6y ago
  No. In other words, controlled or monitored physical access. If I have access to a keyboard connected to CPU, that's a form of "physical access." IO devices are part of the computer.

angry_octet 6y ago

There are many remote access systems: KVM extenders over cables, IP, PCoIP, virtual desktops, Xwindows etc. The problem is the mixture of responsibilities in GDM. Someone decided to use its root permissions for a purpose unrelated to display management.

stjohnswarts 6y ago

That used to be kind of true, but if you're using encrypted filesystems and such it becomes much harder, at least for your average hacker/criminal to get something useful off the system.