I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for the files in that partition. I’m not an expert so I have doubts about how easly can this be cracked.
The context is an office working environment, with some co workers willing (and waiting for) to copy valuable and personal information from my laptop. We usually work in the same “conference room” with only one table so the physical access to the laptop is easy. The chances of stealing the laptop is low due to security checkins . The true crypt volume with the protected data folder will be usually mounted while i'm in that room.
A planed attack combining local and remote methods is highly likely. This is, installing a Trojan/keylogger having physical access to the laptop to later use it to steal the info.
-Weakness : Even tho I try to lock the windows screen every time I leave a shared room, some few times I’ve forgot it (for example if I need to do something outside in a hurry and ill back later). Also, even I set my screen saver to lock the windows account after 5 mins of inactivity, the attacker could move the pad mouse to keep it active after I leave the room. I have an antivirus installed but as we know that sometimes isn’t enough.
The time that the attacker has psychically alone with the laptop to perform the attack could be around 3 -5 minutes.
A possible attack will look like this:
- I leave the room, the account isn’t blocked, the attacker sees the opportunity and install the Trojan/keylogger.
- the windows account password is captured.
- the hibersys file is uploaded later to the attackers server as well as the target folders.
- the files are decrypted with some tool. (like elcomsoft ) http://blog.crackpassword.com/2012/12/elcomsoft-decrypts-bitlocker-pgp-and-truecrypt-containers/ it would be that easy? Am I missing something here? Should ill be worry ?
And what would you recommend to avoid this?
Thanks in advance.
PDTA: after the first incident, I formatted my hard drive and I haven't been in the office since vacations. I'm going back the next week.