4 ms·

For anyone seriously considering Tails, do invest either in a laptop with a dvd drive and run rails off non writable storage, or use something like a hardware s

by diziet 13y ago

For anyone seriously considering Tails, do invest either in a laptop with a dvd drive and run rails off non writable storage, or use something like a hardware switchable write usb: http://www.amazon.com/Kanguru-Solutions-Flash-Write-Protect-KF3WP-32G/dp/B008OGNMEI/ http://www.amazon.com/Kanguru-Solutions-Flash-Write-Protect-...

GimbalLock 13y ago
Could you expound on why?
- garrettgrimsley 13y ago
  An adversary could modify your image. It's possible that they could have your copy phone home through a non-anonymized route, revealing information about your identity. They could also make it so that your route all information through their nodes, or eavesdrop through a built-in microphone or camera. All sorts of nasty things, all with persistence between boots.
  - GimbalLock 13y ago
    Interesting. Do you mean by physically accessing the USB drive and changing it, or software that waits to modify the USB drive once connected? Thank you!
    - garrettgrimsley 13y ago
      I'm not sure what you are asking exactly. I was talking about using a USB drive as the medium for your Tails Live"CD." The point of Tails is that unless you explicitly take action to make changes or save files, nothing that you do will be persistent across restarts. The memory of the PC you were using is wiped, and the medium on which you store the Tails OS has not been modified. The next time you start Tails you will have a fresh copy. No personal information, no settings that could distinguish you from any other vanilla Tails user. You'll be presented with the same toolkit tailored to privacy and security every time. If an attacker is able to compromise one session it is a problem, but maybe they didn't gather the intelligence they needed to de-anonymize you. Now, if they can make it so that your copy of Tails boots with their exploits already loaded, then there's a major problem.
      - GimbalLock 13y ago
        Okay. I got you now. Thanks. I just didn't know how exactly the USB drive was going to get modified by an attacker.
morsch 13y ago
It would be nice if their bootloader "just" loaded the entire image into RAM and let the user continue booting and running without the USB drive attached. Optical drives are on their way out, USB drives with a trustworthy write switch are obscure (if they exist at all) and this seems quite secure. I'm using scare quotes because I don't know how difficult this is.
- BuildTheRobots 13y ago
  Tip: Most laptops have an SD card reader and most full size SDs still have write switches. Also as SystemRescueCD does a load to RAM so it's certainly doable :)
  - garrettgrimsley 13y ago
    This is not safe! The SD card write switches rely on the host to respect the state of the switch[0] [0] http://www.electronics-lab.com/blog/?p=2620 http://www.electronics-lab.com/blog/?p=2620
    - BuildTheRobots 13y ago
      Wow; I had no idea. -Thank you for the warning :)
  - matteotom 13y ago
    Unfortunately, many/most laptops do not support booting from SD cards. If you were to store the main image on an SD card, you'd still need a cd/dvd/usb drive to load the bootloader.
  - diziet 13y ago
    Write switches on SD cards are not hardware specific, the host can choose to ignore them, unfortunately.
  - crdoconnor 13y ago
    >Tip: Most laptops have an SD card reader Not all of them will boot for you though. Mine doesn't.
garrettgrimsley 13y ago
Do note that write-protect switches often only ask that software not write to the drive (Host protect), and are not sufficient to protect against a malicious entity. Unless an examination revealed otherwise it is wise to assume that the write protection media is a software protection, not a hardware protection. http://security.stackexchange.com/questions/4248/how-reliable-is-a-write-protection-switch-on-a-usb-flash-drive http://security.stackexchange.com/questions/4248/how-reliabl...
- deleted 13y ago
  [deleted]
- diziet 13y ago
  I'd read that same SE thread a while back and concluded that write protect drive switches is a good solution I could trust!
- joosters 13y ago
  SD cards have a physical switch to write-protect them, but the logic & protection is done in software. For example, there's a project that provides replacement firmware for Canon cameras - http://chdk.wikia.com/wiki/CHDK http://chdk.wikia.com/wiki/CHDK - stored on the SD card. The new firmware is selected by moving the write-protect switch on the card. In either configuration, the camera can still save new photos to the storage.
Crito 13y ago
You can get USB DVD drives pretty cheap these days. Probably not the most performant, but much cheaper than buying a new laptop.
StavrosK 13y ago
Can't you get one of those U3 drives that appear as a USB DVD drive? It requires loads of time and special software to reflash, but I'm not sure if they're available any more. Then again, a malicious actor may just go through the trouble of bypassing the protections.
ef47d35620c1 13y ago
You could also remove the hard drive. It's very easy to do and would prevent any accidental write.
deleted 12y ago
[deleted]
secfirstmd 12y ago
If you are going to use it on a DVD drive or otherwise then make sure your update it regularly (ie: download and burn a new DVD etc) to make sure your OS and various tools have the latest patches. Otherwise you are much more vulnerable. All the time people forget and end up using a very old version.

by diziet 13y ago

GimbalLock 13y ago

Could you expound on why?

garrettgrimsley 13y ago
An adversary could modify your image. It's possible that they could have your copy phone home through a non-anonymized route, revealing information about your identity. They could also make it so that your route all information through their nodes, or eavesdrop through a built-in microphone or camera. All sorts of nasty things, all with persistence between boots.
- GimbalLock 13y ago
  Interesting. Do you mean by physically accessing the USB drive and changing it, or software that waits to modify the USB drive once connected? Thank you!
  - garrettgrimsley 13y ago
    I'm not sure what you are asking exactly. I was talking about using a USB drive as the medium for your Tails Live"CD." The point of Tails is that unless you explicitly take action to make changes or save files, nothing that you do will be persistent across restarts. The memory of the PC you were using is wiped, and the medium on which you store the Tails OS has not been modified. The next time you start Tails you will have a fresh copy. No personal information, no settings that could distinguish you from any other vanilla Tails user. You'll be presented with the same toolkit tailored to privacy and security every time. If an attacker is able to compromise one session it is a problem, but maybe they didn't gather the intelligence they needed to de-anonymize you. Now, if they can make it so that your copy of Tails boots with their exploits already loaded, then there's a major problem.
    - GimbalLock 13y ago
      Okay. I got you now. Thanks. I just didn't know how exactly the USB drive was going to get modified by an attacker.

morsch 13y ago

It would be nice if their bootloader "just" loaded the entire image into RAM and let the user continue booting and running without the USB drive attached. Optical drives are on their way out, USB drives with a trustworthy write switch are obscure (if they exist at all) and this seems quite secure. I'm using scare quotes because I don't know how difficult this is.

BuildTheRobots 13y ago
Tip: Most laptops have an SD card reader and most full size SDs still have write switches. Also as SystemRescueCD does a load to RAM so it's certainly doable :)
- garrettgrimsley 13y ago
  This is not safe! The SD card write switches rely on the host to respect the state of the switch[0] [0] http://www.electronics-lab.com/blog/?p=2620 http://www.electronics-lab.com/blog/?p=2620
  - BuildTheRobots 13y ago
    Wow; I had no idea. -Thank you for the warning :)
- matteotom 13y ago
  Unfortunately, many/most laptops do not support booting from SD cards. If you were to store the main image on an SD card, you'd still need a cd/dvd/usb drive to load the bootloader.
- diziet 13y ago
  Write switches on SD cards are not hardware specific, the host can choose to ignore them, unfortunately.
- crdoconnor 13y ago
  >Tip: Most laptops have an SD card reader Not all of them will boot for you though. Mine doesn't.

garrettgrimsley 13y ago

Do note that write-protect switches often only ask that software not write to the drive (Host protect), and are not sufficient to protect against a malicious entity. Unless an examination revealed otherwise it is wise to assume that the write protection media is a software protection, not a hardware protection. http://security.stackexchange.com/questions/4248/how-reliable-is-a-write-protection-switch-on-a-usb-flash-drive http://security.stackexchange.com/questions/4248/how-reliabl...

deleted 13y ago
[deleted]
diziet 13y ago
I'd read that same SE thread a while back and concluded that write protect drive switches is a good solution I could trust!
joosters 13y ago
SD cards have a physical switch to write-protect them, but the logic & protection is done in software. For example, there's a project that provides replacement firmware for Canon cameras - http://chdk.wikia.com/wiki/CHDK http://chdk.wikia.com/wiki/CHDK - stored on the SD card. The new firmware is selected by moving the write-protect switch on the card. In either configuration, the camera can still save new photos to the storage.

Crito 13y ago

You can get USB DVD drives pretty cheap these days. Probably not the most performant, but much cheaper than buying a new laptop.

StavrosK 13y ago

Can't you get one of those U3 drives that appear as a USB DVD drive? It requires loads of time and special software to reflash, but I'm not sure if they're available any more. Then again, a malicious actor may just go through the trouble of bypassing the protections.

ef47d35620c1 13y ago

You could also remove the hard drive. It's very easy to do and would prevent any accidental write.

deleted 12y ago

[deleted]

secfirstmd 12y ago

If you are going to use it on a DVD drive or otherwise then make sure your update it regularly (ie: download and burn a new DVD etc) to make sure your OS and various tools have the latest patches. Otherwise you are much more vulnerable. All the time people forget and end up using a very old version.