4 ms·

> What about for the scenario when it gets swiped during the work day when I'm in the bathroom? Can you help me understand what attacks you think can be done w

> What about for the scenario when it gets swiped during the work day when I'm in the bathroom? Can you help me understand what attacks you think can be done with a locked screen, powered on laptop ? (given Full disk encryption is on)

neolog 6y ago
Does linux have a screen locker that is reasonably secure?
- delroth 6y ago
  Against what threat model? The general answer is "yes, most of them, including all the ones being used as defaults in major distros" -- they will not allow a user that isn't in possession of the password to log back into the session. They don't necessarily prevent against other threat models, like "the attacker dumps the laptop's RAM" (which you could technically protect against if you froze all session processes and encrypted their working set with a key held in a secure element).
tgsovlerkhgsel 6y ago
DMA attacks - once you get access to a bus that allows direct memory access, you can unlock the machine. Not something a thief that wants the laptop would do, but definitely something a targeted attacker who specifically steals a laptop to get your data would do.
laurent92 6y ago
In theory, you can keep the RAM powered and read the decryption key from it. I believe a system like Apple’s Secure Enclave (everything contained in one chip) is better in that regard, although I’m not an expert.
yabones 6y ago
Another commenter mentioned DMA, so I'll expand on that. If the device has only USB, network, and display outputs, not a lot. Modern systems are pretty hardened with this config. However, if it has Thunderbolt, ExpressCard, PCMCIA, or even FireWire, it's hosed. This kind of attack has been highly researched by intelligence, for example the 'Sonic Screwdriver' attack revealed in 2017 [1] targeted Macs by tampering with boot parameters, and was installed over thunderbolt. There have also been some PoC exploits for extracting BitLocker encryption keys out of memory using FireWire [2], though I'm not sure those have ever been widespread attack vectors. Basically, the old adage still holds up - physical access is full access. The only thing you can really do is fill up any ports that could be used for DMA sidechannel attacks with epoxy, then hope nobody attacks your TCP stack or USB controller... --- [1] https://arstechnica.com/information-technology/2017/03/new-wikileaks-dump-the-cia-built-thunderbolt-exploit-implants-to-target-macs/ https://arstechnica.com/information-technology/2017/03/new-w... [2] https://support.microsoft.com/en-ca/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d https://support.microsoft.com/en-ca/help/2516445/blocking-th...
- qmarchi 6y ago
  There's some lienience to be given with the newer versions of Thunderbolt. On many Windows machines, and given that it's configured correctly, a TB device has to be explicitly allowed to access anything other than USB and Display modes.

neolog 6y ago

Does linux have a screen locker that is reasonably secure?

delroth 6y ago
Against what threat model? The general answer is "yes, most of them, including all the ones being used as defaults in major distros" -- they will not allow a user that isn't in possession of the password to log back into the session. They don't necessarily prevent against other threat models, like "the attacker dumps the laptop's RAM" (which you could technically protect against if you froze all session processes and encrypted their working set with a key held in a secure element).

tgsovlerkhgsel 6y ago

DMA attacks - once you get access to a bus that allows direct memory access, you can unlock the machine. Not something a thief that wants the laptop would do, but definitely something a targeted attacker who specifically steals a laptop to get your data would do.

laurent92 6y ago

In theory, you can keep the RAM powered and read the decryption key from it. I believe a system like Apple’s Secure Enclave (everything contained in one chip) is better in that regard, although I’m not an expert.

yabones 6y ago

Another commenter mentioned DMA, so I'll expand on that. If the device has only USB, network, and display outputs, not a lot. Modern systems are pretty hardened with this config. However, if it has Thunderbolt, ExpressCard, PCMCIA, or even FireWire, it's hosed. This kind of attack has been highly researched by intelligence, for example the 'Sonic Screwdriver' attack revealed in 2017 [1] targeted Macs by tampering with boot parameters, and was installed over thunderbolt. There have also been some PoC exploits for extracting BitLocker encryption keys out of memory using FireWire [2], though I'm not sure those have ever been widespread attack vectors. Basically, the old adage still holds up - physical access is full access. The only thing you can really do is fill up any ports that could be used for DMA sidechannel attacks with epoxy, then hope nobody attacks your TCP stack or USB controller... --- [1] https://arstechnica.com/information-technology/2017/03/new-wikileaks-dump-the-cia-built-thunderbolt-exploit-implants-to-target-macs/ https://arstechnica.com/information-technology/2017/03/new-w... [2] https://support.microsoft.com/en-ca/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d https://support.microsoft.com/en-ca/help/2516445/blocking-th...

qmarchi 6y ago
There's some lienience to be given with the newer versions of Thunderbolt. On many Windows machines, and given that it's configured correctly, a TB device has to be explicitly allowed to access anything other than USB and Display modes.