WHOLE disk encryption

cyberius · 2012-07-19 21:51:50

I have a question about encryption:

As far as I understand one can encrypt the whole disc except the boot partition (wiki: Dm-crypt_with_LUKS).
But doesn't leave this a big security hole? What if some bad guy gains access to my notebook while I'm away and e.g. takes out my hard disk, modifies some files on boot (installs an key logger?) and puts it back into the notebook. Wouldn't this be possible? I know that with Windows Truecrypt is able to encrypt the whole disk.

So, is it possible? Or is it only possible with an external boot medium, like an USB stick?

fschiff · 2012-07-19 23:39:25

The last part of the wiki article talks about checking the /boot partition to see if its been tampered with, and you can combine cryptphrases and cryptkeys, but honestly a little perspective should be involved:

http://xkcd.com/538/

Last edited by fschiff (2012-07-20 00:13:53)

cyberius · 2012-07-20 08:16:22

fschiff wrote:

The last part of the wiki article talks about checking the /boot partition to see if its been tampered with, and you can combine cryptphrases and cryptkeys, but honestly a little perspective should be involved:
http://xkcd.com/538/

Thank you, I overlooked this. That solution sounds great.

btw, if someone drugs me and reveals the pass-code, then at least I know that my data has been stolen. With a keylogger someone could get my files unnoticed.

Last edited by cyberius (2012-07-20 08:16:32)

safrax · 2012-07-20 18:43:17

Password protect the bios and password protect the bootloader. That's about the best you can do. If the bios password is gone from your computer, assume it's been tampered with and scorched earth it.

R00KIE · 2012-07-20 19:52:07

Disk encryption works fine, even with a /boot that is not encrypted in case your computer is stolen by a thief looking for easy profit. For most other cases it is a moot point to encrypt your disk since you will be compelled to decrypt it.

progandy · 2012-07-20 20:07:47

cyberius wrote:

As far as I understand one can encrypt the whole disc except the boot partition (wiki: Dm-crypt_with_LUKS).
But doesn't leave this a big security hole?

Thats' why they invented securebooot (but the implementation is done poorly. A password protected certificate which can be modified by the user would have been better: User creates assymetric key, signs the bootloaders and adds the public key password protected to UEFI.)

cyberius wrote:

Or is it only possible with an external boot medium, like an USB stick?

That's the only secure way. Checking boot after the decryption won't work too well, the keylogger could delete itself from /boot before you check the hashes.

R00KIE · 2012-07-20 21:43:24

When you lose physical control over your machine it's game over, there is always some way to spy on you without you noticing.

Wilco · 2012-07-21 17:57:02

What you're refering to is known as an evil maid attack, where an "evil maid" modifies your system without you knowing it. Afterwards the evil maid tries to recover your secret password.

If you use dm-crypt and leave /boot unencrtyped (like you should) you can install chkboot from AUR:
https://aur.archlinux.org/packages.php?ID=56934

I've tested chkboot pretty thoroughly and it notices every change I could think of. I've changed small parts of the MBR, added /boot/captured.password.test.txt, modified kernel images and simply "touch" some files inside the boot partition.

Because I have all my partitions encrypted, including /swap and other data partitions only /boot and the mbr can be written to. And every change to either /boot or the mbr (including kernel updates) results in a warning after I log in. So the chkboot solution is probably evil maid proof. The only two other problems I can get is when someone installs a hardware keylogger inside my laptop, or simply puts a gun to my head.

cyberius · 2012-07-22 12:16:39

Wilco wrote:

The only two other problems I can get is when someone installs a hardware keylogger inside my laptop, or simply puts a gun to my head.

I think that it involves much more technical skills / knowledge to install/set up a hardware key-logger than modifying the boot-loader. So I think the little script does a good job lowering the risk of being spied on unnoticed!

Last edited by cyberius (2012-07-22 12:28:36)

Arch Linux

#1 2012-07-19 21:51:50

WHOLE disk encryption

#2 2012-07-19 23:39:25

Re: WHOLE disk encryption

#3 2012-07-20 08:16:22

Re: WHOLE disk encryption

#4 2012-07-20 18:43:17

Re: WHOLE disk encryption

#5 2012-07-20 19:52:07

Re: WHOLE disk encryption

#6 2012-07-20 20:07:47

Re: WHOLE disk encryption

#7 2012-07-20 21:43:24

Re: WHOLE disk encryption

#8 2012-07-21 17:57:02

Re: WHOLE disk encryption

#9 2012-07-22 12:16:39

Re: WHOLE disk encryption

Board footer