4 ms·

What if attacker infects unencrypted part used for booting? Do you have protection against that? It's relatively easy on Linux, where /boot is usually not encr

What if attacker infects unencrypted part used for booting? Do you have protection against that? It's relatively easy on Linux, where /boot is usually not encrypted.

scott_karana 13y ago
Agreed, but typically /boot isn't automounted when it's a separate partition, which means they would need a root-access compromise already.
- claudius 13y ago
  They can replace the booting kernel. Unless you use SecureBoot, TPM or some such thing, there is no way to protect against that (assuming that the attacker has access to the shut-down system at one point and you boot it later).
- mike_esspe 13y ago
  Hetzner allows to netboot any server via admin panel. After booting into recovery os, you can modify unencrypted parts as you wish.
FooBarWidget 13y ago
The trick is putting all important data in the encrypted part. The unencrypted part must be reconstructable in an automated manner. If you are paranoid and you assume that all unplanned reboots are attacks, then you can reconstruct the unencrypted part every time. Tools like Chef make this relatively easy.
- sneak 13y ago
  The kernel lives on /boot, and could be subverted to lie about its uptime to convince you that there was no unplanned reboot. This is the same methodology I use, and I think about these attacks a lot. There is no good/cheap way to verify a remote execution environment right now with commodity hardware. :/
  - FooBarWidget 13y ago
    That's not possible. Even if you fool the kernel, you still can't mount the encrypted disk. The fact that the encrypted disk is not mounted is proof that there has been an unplanned reboot.
- Estragon 13y ago
  Wow, do you actually reconstruct /boot on every unplanned reboot, yourself?
  - FooBarWidget 13y ago
    I don't know. Ever since we set up encrypted disks we haven't had an unplanned reboot. I was simply pointing out that this is a possibility that we've considered.

What if attacker infects unencrypted part used for booting? Do you have protection against that? It's relatively easy on Linux, where /boot is usually not encrypted.

scott_karana 13y ago

Agreed, but typically /boot isn't automounted when it's a separate partition, which means they would need a root-access compromise already.

claudius 13y ago
They can replace the booting kernel. Unless you use SecureBoot, TPM or some such thing, there is no way to protect against that (assuming that the attacker has access to the shut-down system at one point and you boot it later).
mike_esspe 13y ago
Hetzner allows to netboot any server via admin panel. After booting into recovery os, you can modify unencrypted parts as you wish.

FooBarWidget 13y ago

The trick is putting all important data in the encrypted part. The unencrypted part must be reconstructable in an automated manner. If you are paranoid and you assume that all unplanned reboots are attacks, then you can reconstruct the unencrypted part every time. Tools like Chef make this relatively easy.

sneak 13y ago
The kernel lives on /boot, and could be subverted to lie about its uptime to convince you that there was no unplanned reboot. This is the same methodology I use, and I think about these attacks a lot. There is no good/cheap way to verify a remote execution environment right now with commodity hardware. :/
- FooBarWidget 13y ago
  That's not possible. Even if you fool the kernel, you still can't mount the encrypted disk. The fact that the encrypted disk is not mounted is proof that there has been an unplanned reboot.
Estragon 13y ago
Wow, do you actually reconstruct /boot on every unplanned reboot, yourself?
- FooBarWidget 13y ago
  I don't know. Ever since we set up encrypted disks we haven't had an unplanned reboot. I was simply pointing out that this is a possibility that we've considered.