Re:Eagle scout. Idealist. Drug trafficker?
by Everlag on Sunday January 19, 2014 @01:10AM
(#7083571)
I generally prefer the idea of a thermite charge planted on the ram. Cold boot? Try that when the dram goes from 40 to 300 in two seconds.
Then again, encrypting your drive and making sure the encryption key is safe might be slightly more sane than turning your macbook into a puddle of aluminium.
Linux has functionality to wipe encryption keys from memory (and require their re-entry) without unmounting the encrypted filesystem (see "luksSuspend" in the cryptsetup man page). Unfortunately, I don't know of any screen locks that automatically tie into it.
[2] is not really an issue:
http://www1.informatik.uni-erlangen.de/tresor
Re:Eagle scout. Idealist. Drug trafficker?
by EthanHeilman on Sunday January 19, 2014 @02:53AM
(#7083786)
Tresor is really cool but most disk encryption stores the master key in RAM. *
Even assuming that your master encryption key can't be extracted from RAM, coldbooting is still a threat.
For instance they get anything in RAM (files being edited, program state, passwords, emails, web cookies).
Maybe you played a RAM intensive video game that overwrote everything or perhaps you just finished writing a quicken books entry for your counterfeiting operation. Do you feel lucky?
* You can patch your kernel so that DM-crypt uses Tresor, so it is possible. I don't know how it handles the inode keys. http://www1.informatik.uni-erlangen.de/tresor?q=content/read...
This exists, it is called pamusb[1] and it allows you to automatically log in and log out using a usb stick. It would be simple to add password as well. The problem is, if your machine is still powered on, they can patch into the PCI bus and dump your RAM using DMA[2]. Most disk encryption stores the master key in RAM, so if they can dump your RAM they can decrypt your harddrive. GAME OVER!
You really want something that cuts power to your laptop so all state is lost. It's not hard to build such a thing:
1. Setup your laptop to use full disk encryption,
2. remove the battery from your laptop,
3. pull the power cord to "instantly log out".
One could even attach a string from the power cord to the door so that the laptop loses power if the door is opened. Cold-boot attacks[3], where they remove your RAM before it loses state, could be a concern, but they would have to disassemble your laptop very very quickly (within 30 seconds, perhaps longer if they just threw the laptop into a tub of liquid nitrogen). A counter measure would be to epoxy your laptop together to prevent quick disassembly (or use a macbook air those things are impossible to take apart quickly and the RAM is soldered in place).
It should be standard operating procedure to randomly overwrite all non-OS data stored RAM when a user logs out. Maybe someone with most experience in disk encryption can tell me which products do this.
[1]: http://pamusb.org/
[2]: http://en.wikipedia.org/wiki/DMA_attack
[3]: http://en.wikipedia.org/wiki/Cold_boot_attack