3 ms·

Can you elaborate how you would do that on a mobile device, laptop/pc? Would you run different partitions? Can it be done by giving them one wrong password whi

by yawaworht1978 5y ago

Can you elaborate how you would do that on a mobile device, laptop/pc? Would you run different partitions? Can it be done by giving them one wrong password which will trigger a disc erasure? Serious question, as I wouldn't know how to do that.

klyrs 5y ago
The easiest solution I see is to write a custom screen-lock for Linux. That could be defeated by a simple reboot, but the hapless roommate in this scenario wouldn't know to do that. For example, insert your filesystem-nuke (perhaps with an attempts counter) around line 78 of main.rs here https://github.com/akermu/rlock https://github.com/akermu/rlock
hatboxreappoint 5y ago
Not quite the same but a hidden veracrypt volume [0] would easily circumvent this law. [0] https://veracrypt.eu/en/docs/hidden-volume/ https://veracrypt.eu/en/docs/hidden-volume/
MertsA 5y ago
Look into PAM configuration. In particular I think you'd probably want some combination of pam_faillock and pam_exec. pam_exec can be used to call some arbitrary script to wipe your disks and possibly be extra evil and call flashrom to even wipe the firmware beforehand.
- d110af5ccf 5y ago
  > wipe your disks Actually wiping the disk would take way too long. Assuming that you're running Linux and that all connected drives are fully encrypted: overwrite all keyfiles in a secure manner (ie flushing all caches and etc), write random garbage to the entirety of RAM, and trigger the equivalent of `halt -ff` (note the double --force). Potentially of interest: `__noreturn machine_real_restart` in reboot.c (https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/arch/x86/kernel/reboot.c#L97 https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5...) Bonus points for additionally finding a way to trigger the "secure erase" firmware feature of all attached devices as part of the above sequence. That's likely to prove a bit tricky though since that feature is generally locked out (for obvious reasons) once you leave the bootloader.
  - MertsA 5y ago
    By "wipe your disks" I meant issue a secure erase assuming you have a SSD like Intel's where it would overwrite an encryption key and be done in short order. The contents of RAM in this scenario shouldn't be particularly vulnerable. If they're trying random passwords on the actual machine without any attempt to preserve the disks beforehand there's zero chance they're about to take the machine apart and extract what's left in RAM before it's gone. >Potentially of interest: `__noreturn machine_real_restart` in reboot.c Just write "b" to /proc/sysrq-trigger, it'll immediately trigger an ungraceful reboot without trying to unmount filesystems or flush the cache.

klyrs 5y ago

The easiest solution I see is to write a custom screen-lock for Linux. That could be defeated by a simple reboot, but the hapless roommate in this scenario wouldn't know to do that. For example, insert your filesystem-nuke (perhaps with an attempts counter) around line 78 of main.rs here https://github.com/akermu/rlock https://github.com/akermu/rlock

hatboxreappoint 5y ago

Not quite the same but a hidden veracrypt volume [0] would easily circumvent this law. [0] https://veracrypt.eu/en/docs/hidden-volume/ https://veracrypt.eu/en/docs/hidden-volume/

MertsA 5y ago

Look into PAM configuration. In particular I think you'd probably want some combination of pam_faillock and pam_exec. pam_exec can be used to call some arbitrary script to wipe your disks and possibly be extra evil and call flashrom to even wipe the firmware beforehand.

d110af5ccf 5y ago
> wipe your disks Actually wiping the disk would take way too long. Assuming that you're running Linux and that all connected drives are fully encrypted: overwrite all keyfiles in a secure manner (ie flushing all caches and etc), write random garbage to the entirety of RAM, and trigger the equivalent of `halt -ff` (note the double --force). Potentially of interest: `__noreturn machine_real_restart` in reboot.c (https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/arch/x86/kernel/reboot.c#L97 https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5...) Bonus points for additionally finding a way to trigger the "secure erase" firmware feature of all attached devices as part of the above sequence. That's likely to prove a bit tricky though since that feature is generally locked out (for obvious reasons) once you leave the bootloader.
- MertsA 5y ago
  By "wipe your disks" I meant issue a secure erase assuming you have a SSD like Intel's where it would overwrite an encryption key and be done in short order. The contents of RAM in this scenario shouldn't be particularly vulnerable. If they're trying random passwords on the actual machine without any attempt to preserve the disks beforehand there's zero chance they're about to take the machine apart and extract what's left in RAM before it's gone. >Potentially of interest: `__noreturn machine_real_restart` in reboot.c Just write "b" to /proc/sysrq-trigger, it'll immediately trigger an ungraceful reboot without trying to unmount filesystems or flush the cache.