5 ms·
Physical access can almost always be leveraged to full system access.
by ax0n 17y ago
Physical access can almost always be leveraged to full system access.
- idlewords 17y agoWhat is of interest here is the small window of time required. You pretty much have to be in constant possession of your laptop (or a USB key that you religiously use to verify your boot record) in order to have any confidence that it has not been compromised.
- timf 17y agoThat is the premise you should start with IMO; which is why this is not interesting. Absolutely you need to avoid releasing physical control of your machine.
- cellis 17y agoJust keep it in a lock case. This solves the problem of Evil Maids, but not of Evil Maids-financed-by-the-NSA-with-lockpickers. I have to imagine that if those types of people were after your encrypted info,you'd know and you'd probably keep it handcuffed to your wrist.
- schnalle 17y agoplease, think of james bond! how could he drink a martini gracefully when a suitcase is chained to his hand?
- borism 17y agojames gracefully holds cocktail glass with both hands? now if he had other hand around woman's waist, that I would understand :)
- timf 17y agoI usually just keep my data on a USB key and then buy a brand new laptop from a random store every time I want to access it.
- vincent_vega 17y agoOh rly?
- ax0n 17y agoFor almost any given scenario to protect a system (even the one you mentioned), there's still likely to be a way to circumvent it if you can surreptitiously tinker with the machine for 30 minutes. This is a minuscule subset of the general rule: There is no such thing as perfect security.
- tptacek 17y agoThe reality is, nobody is going to physically attack your laptop (just don't bring your work machine to Black Hat). But there is an unacceptably high probability that your laptop will get stolen; for instance, you will often leave it in your car, where anyone with a cinderblock can get it in under a minute. TrueCrypt is about the guy with the cinderblock, not about stopping Joanna Rutkowska from installing a keylogger.
- idlewords 17y agoCinderblock is so unwieldy! I'm more of a broken spark plug man: http://www.youtube.com/watch?v=wUgsi9gQBeA http://www.youtube.com/watch?v=wUgsi9gQBeA
- TrevorJ 17y agoWith the current implementation of this hack, you pretty much have to steal the machine once the passcode is sniffed out anyway.
- ube 17y agoThis is the crux of the problem. Physical (and network) access can always break any security because you have a million vectors of attack - physical hardware, software, etc.. . And how secure is your laptop when its in your possession? As laptops become smaller (i.e. netbooks) they'll be as easily stolen as one's wallet. Frankly, most people's data is really not that important and the cinderblock attack is what truecrypt and similar crypto systems prevent. Every time you see a news item about "a million social security numbers have been compromised " - its always due to the cinderblock attack. The "only" way to secure your data is to put your computer it in a vault (unplugged from AC outlet and no network access) with multiple physical security and surrounded by people with guns. If your data is that important and you can afford this sort of security...then the evil maid attack is irrelevant.
- pyre 17y ago> As laptops become smaller (i.e. netbooks) they'll be as easily stolen as one's wallet. On the flipside it's easier to keep a netbook always on your possession than it is even a 12" laptop. So yea, smaller computing devices could be 'easier to pick-pocket' or it could mean 'harder to separate from the user.'