3 ms·

If someone has this level of access and time with the device, implanting a bug and/or setting up a fake machine shouldn't be difficult. How many here would rec

If someone has this level of access and time with the device, implanting a bug and/or setting up a fake machine shouldn't be difficult. How many here would recognize that Evil Maid has swapped out your work machine with an identical model? It would be rigged to boot into an identical login screen and send your password back to the guy with the real laptop. That's what happens when everyone has the same shiny new machines (Apple). Give me a machine with a few scratches and custom boot screen.

morpheuskafka 5y ago
Huh, this actually raises a very good point. We need a mechanism to verify that the machine itself is legitimate before the user interacts with in. Maybe some sort of QR code containing the current time signed by the TPM that could be verified by the users phone?
- hulitu 5y ago
  Yes, blockchain, with NFT.
mtlynch 5y ago
That's true, but the victim would immediately recognize something wrong when they boot into their system and find that none of their files are there and they're not connected to their company's VPN. At that point, it's a race between how quickly the attackers can exploit temporary access to the CEO's network resources and how quickly the CEO and their IT folks figure out that they need to cut off the stolen laptop's network access and user credentials.
- 05 5y ago
  Remote desktop with an HDMI (LVDS?) capture card, so that everything is in place. Alternatively, network mount the SSD once you get the encryption key and boot from that, syncing the blocks on demand. You can even show the 'installing updates' screen to do the HDD sync while it's 'updating'. No wifi connection? no problem - the planted one has an internal 5G modem.
- clipradiowallet 5y ago
  For a darker twist... That moment when when the CEO is back in the hotel room, and realizes he just authenticated to a laptop that was not his would be an ideal moment for the assassin that looks very similar to him to exit the hotel bathroom, pop the CEO, dress in his clothes, and proceed to the bank for wire transfer shenanigans.
- SeriousM 5y ago
  The logon would look broken or very slow, that's how to get credentials without immediate notice
- tpxl 5y ago
  You make the password a random string, so the victim thinks they've forgotten it, buying you time.
- devwastaken 5y ago
  Not if you give 1 out of thousands of errors windows loves to give. There's one where when you login all your user profile stuff is gone! People are very used to windows breaking.
- morpheuskafka 5y ago
  Just show an error message--ideally one that implies there was no connectivity at all (ex. "We can’t sign you with this credential because your domain isn’t available."). That way, if the users happens to contact IT, they won't think there is anything anomalous about the lack of logged attempts.
  - IshKebab 5y ago
    Ha that's what I did decades ago in school with a fake login screen. When the password has been logged just read c:\con\con, crash the machine and it reboots into the real login screen. You don't need login to succeed, just fail convincingly.
literallyaduck 5y ago
If you break the display they will be less likely to discover it. They will be more concerned with trying to find a cable to hook it up to an external display buying you time. If you make it power off at intervals they will assume it was damaged not replaced.

morpheuskafka 5y ago

Huh, this actually raises a very good point. We need a mechanism to verify that the machine itself is legitimate before the user interacts with in. Maybe some sort of QR code containing the current time signed by the TPM that could be verified by the users phone?

hulitu 5y ago
Yes, blockchain, with NFT.

mtlynch 5y ago

That's true, but the victim would immediately recognize something wrong when they boot into their system and find that none of their files are there and they're not connected to their company's VPN. At that point, it's a race between how quickly the attackers can exploit temporary access to the CEO's network resources and how quickly the CEO and their IT folks figure out that they need to cut off the stolen laptop's network access and user credentials.

05 5y ago
Remote desktop with an HDMI (LVDS?) capture card, so that everything is in place. Alternatively, network mount the SSD once you get the encryption key and boot from that, syncing the blocks on demand. You can even show the 'installing updates' screen to do the HDD sync while it's 'updating'. No wifi connection? no problem - the planted one has an internal 5G modem.
clipradiowallet 5y ago
For a darker twist... That moment when when the CEO is back in the hotel room, and realizes he just authenticated to a laptop that was not his would be an ideal moment for the assassin that looks very similar to him to exit the hotel bathroom, pop the CEO, dress in his clothes, and proceed to the bank for wire transfer shenanigans.
SeriousM 5y ago
The logon would look broken or very slow, that's how to get credentials without immediate notice
tpxl 5y ago
You make the password a random string, so the victim thinks they've forgotten it, buying you time.
devwastaken 5y ago
Not if you give 1 out of thousands of errors windows loves to give. There's one where when you login all your user profile stuff is gone! People are very used to windows breaking.
morpheuskafka 5y ago
Just show an error message--ideally one that implies there was no connectivity at all (ex. "We can’t sign you with this credential because your domain isn’t available."). That way, if the users happens to contact IT, they won't think there is anything anomalous about the lack of logged attempts.
- IshKebab 5y ago
  Ha that's what I did decades ago in school with a fake login screen. When the password has been logged just read c:\con\con, crash the machine and it reboots into the real login screen. You don't need login to succeed, just fail convincingly.

literallyaduck 5y ago

If you break the display they will be less likely to discover it. They will be more concerned with trying to find a cable to hook it up to an external display buying you time. If you make it power off at intervals they will assume it was damaged not replaced.