3 ms·

Agreed in general — but note that what you described is slightly different. It isn't just "unrestricted physical access", but: * unrestricted physical access,

by jwr 13y ago

Agreed in general — but note that what you described is slightly different. It isn't just "unrestricted physical access", but: * unrestricted physical access, * machine returned to the original user, enough time must pass for the user to enter the password, * unrestricted physical access again. Also, I'm not sure if you've seen a Mac inside lately — most recent ones do not have a SATA flash drive. And even in those that do, finding enough space to place your device would be at least very challenging (if not outright impossible). And if we're speaking about a Mac, it's actually quite impressive how much you can improve your security just by enabling FileVault.

jstanley 13y ago
You don't necessarily need physical access the second time. You can just wait for an internet connection.
AnthonyMouse 13y ago
> Also, I'm not sure if you've seen a Mac inside lately — most recent ones do not have a SATA flash drive. And even in those that do, finding enough space to place your device would be at least very challenging (if not outright impossible). This is just details. An attacker isn't limited to not modifying the device. If you need space you can remove half of the memory (or all of it and replace it with fewer higher density sticks), or remove the cooling fan, or install a slightly smaller battery. Do your key logging directly on the physical input device instead of using virtualization if that's easier, or go the other way and do it entirely in software by altering the necessarily unencrypted code on the device that bootstraps to a password prompt. In the worst case the attacker can just take the entire device and replace it with one that appears identical up to the point where the user types the FileVault password, then transmits the password to the attacker over cellular.
- stcredzero 13y ago
  If you need space you can remove half of the memory I would notice if I didn't have 16GB. or remove the cooling fan Any tech person is going to notice the difference in about 40 minutes. I know this because I once didn't seat the plug for the fan correctly on my girlfriend's Macbook. or install a slightly smaller battery This isn't going to be so simple. There's electronics in the battery that talks to other hardware in your Macbook. That said, it's one of the most accessible and fastest to replace components in a Macbook. A spy-agency could manufacture a battery with he addition of a little microcontroller with its own cellular broadband. It's probably within the technical capabilities of such an organization to be able to use accelerometers and microphones to determine keystrokes enough to greatly narrow down the search space for passwords. The device should be able to sense when the machine comes back from sleep mode very easily, and a cluster of characters typed shortly after that is likely to be the password.

by jwr 13y ago

jstanley 13y ago

You don't necessarily need physical access the second time. You can just wait for an internet connection.

AnthonyMouse 13y ago

> Also, I'm not sure if you've seen a Mac inside lately — most recent ones do not have a SATA flash drive. And even in those that do, finding enough space to place your device would be at least very challenging (if not outright impossible). This is just details. An attacker isn't limited to not modifying the device. If you need space you can remove half of the memory (or all of it and replace it with fewer higher density sticks), or remove the cooling fan, or install a slightly smaller battery. Do your key logging directly on the physical input device instead of using virtualization if that's easier, or go the other way and do it entirely in software by altering the necessarily unencrypted code on the device that bootstraps to a password prompt. In the worst case the attacker can just take the entire device and replace it with one that appears identical up to the point where the user types the FileVault password, then transmits the password to the attacker over cellular.

stcredzero 13y ago
If you need space you can remove half of the memory I would notice if I didn't have 16GB. or remove the cooling fan Any tech person is going to notice the difference in about 40 minutes. I know this because I once didn't seat the plug for the fan correctly on my girlfriend's Macbook. or install a slightly smaller battery This isn't going to be so simple. There's electronics in the battery that talks to other hardware in your Macbook. That said, it's one of the most accessible and fastest to replace components in a Macbook. A spy-agency could manufacture a battery with he addition of a little microcontroller with its own cellular broadband. It's probably within the technical capabilities of such an organization to be able to use accelerometers and microphones to determine keystrokes enough to greatly narrow down the search space for passwords. The device should be able to sense when the machine comes back from sleep mode very easily, and a cluster of characters typed shortly after that is likely to be the password.