News for hackers. Stuff that matters.

A comment on Usbkill – anti-forensic tool to halt computer when new USB device is connected. Parent comment

Re:Usbkill – anti-forensic tool to halt computer when new US... by _kbh_ on Thursday August 06, 2020 @07:02AM (#24069843)
Memory encryption technologies such as AMD's Secure Encrypted Memory (SME). Would be your best bet to combat this, along with other anti-evil maid protections.

https://en.wikichip.org/wiki/x86/sme#Overview https://www.qubes-os.org/doc/anti-evil-maid/

[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by captainmuon on Thursday August 06, 2020 @09:11AM (#24070535)
There are also things like TRESOR [1] which keep all encryption keys inside the CPU. I'm not sure what the current state of the art is.

There are so many possible evil maid attacks that I think it would be useful to add a pysical layer, just in case.

[1] https://en.wikipedia.org/wiki/TRESOR

[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by _kbh_ on Friday August 07, 2020 @06:53AM (#24080513)
TRESOR is a great project but pretty seperate to SME imo. TESOR implements SME but its implemented effectively in software, making it less secure and a lot slower. The great thing about SME on AMD CPUs is that I believe (at least on the newer Zen cores) it effectively can run at the speed of the memory, so you have no performance loss.
[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by stjohnswarts on Thursday August 06, 2020 @08:37PM (#24076850)
I think SEV is newer form of this.
[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by _kbh_ on Friday August 07, 2020 @06:51AM (#24080501)
Secure Encrypted Virtualisation uses SEM, but it is not a newer version of it. SEV allows someone to run encrypted VMs that not even the host can read the memory, by leveraging per VMs keys in the AMD PSP that encrypt the VMs pages using SEM.

It would be interesting to leverage SEM to run a version of qubes where not only are the VMs isolated by the Xen hypervisor but are also separately encrypted using the PSP.

[ Parent | on HN ]