Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  • I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for the files in that partition. I’m not an expert so I have doubts about how easly can this be cracked.

  • The context is an office working environment, with some co workers willing (and waiting for) to copy valuable and personal information from my laptop. We usually work in the same “conference room” with only one table so the physical access to the laptop is easy. The chances of stealing the laptop is low due to security checkins . The true crypt volume with the protected data folder will be usually mounted while i'm in that room.

  • A planed attack combining local and remote methods is highly likely. This is, installing a Trojan/keylogger having physical access to the laptop to later use it to steal the info.

-Weakness : Even tho I try to lock the windows screen every time I leave a shared room, some few times I’ve forgot it (for example if I need to do something outside in a hurry and ill back later). Also, even I set my screen saver to lock the windows account after 5 mins of inactivity, the attacker could move the pad mouse to keep it active after I leave the room. I have an antivirus installed but as we know that sometimes isn’t enough.

  • The time that the attacker has psychically alone with the laptop to perform the attack could be around 3 -5 minutes.

  • A possible attack will look like this:

    1. I leave the room, the account isn’t blocked, the attacker sees the opportunity and install the Trojan/keylogger.
    2. the windows account password is captured.
    3. the hibersys file is uploaded later to the attackers server as well as the target folders.
    4. the files are decrypted with some tool. (like elcomsoft ) http://blog.crackpassword.com/2012/12/elcomsoft-decrypts-bitlocker-pgp-and-truecrypt-containers/ it would be that easy? Am I missing something here? Should ill be worry ?

And what would you recommend to avoid this?

Thanks in advance.

PDTA: after the first incident, I formatted my hard drive and I haven't been in the office since vacations. I'm going back the next week.

share|improve this question
3  
If your data have been stolen, you have to investigate the incident with the help of security officers in your company. If keyloggers have been installed, you cannot trust your laptop period. As for the future, what prevents you from putting the laptop to sleep/hibernation? And last, but not least: if you cannot trust your colleagues, don't work in such an outfit, or move to secure premises. P.S. WHY do you keep valuable personal information in a supposedly high-threat environment? –  Deer Hunter Jan 18 '13 at 6:08
    
@Deer Hunter: forgot to mention that the laptop harddrive was formatted. read the "weaknes " part as I addressed the hibernation/sleep (or lock windows) part. I don't agree that people should quit and find another job because they don't trust their co-workers, but deal with it instead. about the PS. That's a good question but the answer is simply because sometimes I need to use those files while I'm in the office. –  user1338101 Jan 18 '13 at 16:29

3 Answers 3

up vote 7 down vote accepted

Physical presence of an attacker is the hardest to defend against. Some products consider "physical presence" as sign of ownership and allow full rights to the person in front of the machine. For example, motherboards that allow to reset BIOS passwords so as not to lock out an user who forgot his password.

The EFS + TrueCrypt solution is good but it depends on the security of your passwords. Your data is encrypted safely but your passwords are not protected against interception. Keylogging is a simple way of intercepting your passwords but most known keyloggers will be detected by an Antivirus. The attacker can run a program on your computer that looks like TrueCrypt and will send your password to the attacker.

If you leave your computer unlocked in a hostile environment, you cannot have any expectation of privacy and security. There is no way to be 100% sure that you can detect and disrupt an intrusion after the fact. Locking your computer is very easy and you should make a habit out of doing it. Pressing Windows key + L will lock Windows and CTRL + ALT + L will lock most Linux desktop environments.

EFS in Windows Vista and later will encrypt pagafile.sys but not hyberfil.sys which can be used to extract TrueCrypt keys.

TrueCrypt Unencrypted Data in RAM:

Microsoft does not provide any appropriate API for handling hibernation and shutdown, master keys used for system encryption cannot be reliably (and are not) erased from RAM when the computer hibernates, is shut down or restarted.

Use TrueCrypt full disk encryption to encrypt all of your hard drive.

One weakness of TrueCrypt full disk encryption is when the attacker has physical access multiple times. The attack goes by the name Evil Maid and is mitigated by the use of TPM. Basically, the attacker modifies the TrueCrypt password check code to store the typed password in cleartext for later retrieval. The same goes for other full disk encryption products. Use TPM features if your laptop provide them. Take your laptop at home or lock it with a key if you want more security than Truecrypt can provide.

Update:

One ingenious solution for automatically locking your computer is using this program: http://stevetarzia.com/sonar/. It uses echoes to "see" if you are no longer in front of your computer.

There are similar solutions using the webcam. https://www.keylemon.com/product/

share|improve this answer
    
Hey you say EFS in Windows Vista and later will encrypt pagafile.sys but not hyberfil.sys which can be used to extract TrueCrypt keys. Am I correct in thinking that if Truecrypt drives are unmounted then the keys will not be written to the hiberfil.sys? If so then making sure to unmount your Truecrypt drives every time before you hibernate would help. –  culix Jan 18 '13 at 14:48
1  
That is correct. "When a non-system TrueCrypt volume is dismounted, TrueCrypt erases its master keys" However: truecrypt.org/docs/?s=unencrypted-data-in-ram –  Cristian Dobre Jan 18 '13 at 15:57
    
@Cristian Dobre thanks for your answer. Yes , must keyloggers are detected, but other posing as a "legit" programs aren't. an attacker willing to perfom such attack could spend 1 hour or 2 checking the right one. I use Windows+L nearly every time i left , but there's the human factor...for example, you need to go to the other side of the office in a hurry...in 5 months there's a chance to forget to do windows+L a couple of times so I can't depend on it only. on the other hand your advice about TMP sounds quite good. I didn't know it but i'll look into it. –  user1338101 Jan 18 '13 at 22:21
    
@CristianDobre about the sonar solution, sadly , It didn't work in my laptop. but keylemon seems like a very stable program with plenty of important customers like fujitsu , toshiba and others. I'll test it to see if I pay for the paid edition (that one has the windows lock option while the free doesn't). I think im going to post an update to tell what options I'm going to implement so others in the same situation can check it out –  user1338101 Jan 18 '13 at 22:26
    
@CristianDobre: this could sound foolish but.. I wonder how much protection it'll add if i just follow an advice and work only with a non-administrative rights account and just change it to admin or even log a different admin account just for those situations that I have to. (I don't usually install things in my office so it won't be a big proble for me). That way an average user couldn't install a keylogger, and since the files are encrypted with EFS they can copy them but no open them. –  user1338101 Jan 18 '13 at 22:42

I don't understand why disabling hibernation and removing the firewire drivers from the system isn't a solution. As the article that was linked to above suggests the way get around the firewire method is to remove the drivers. Second. We keep hearing the decryption program removes the keys from the hibernation file. Fine. Disable that via a registry key. Won't this make it safe now?

share|improve this answer
    
While the information here might be correct and useful, this doesn't really offer an answer to question itself and is better left as a comment. –  Adnan Nov 8 '13 at 10:13

I agree with all that @CristianDobre has written, you have an extremely difficult security situation on your hands which Truecrypt isn't going to solve. If your co-workers have unrestricted access to your machine and bad intentions then you cannot protect your machine, or any information on it as your passwords could be read. Even if they weren't your attackers could hack your machine and log into it while you have truecrypt up and running with the drive mounted and access it that way. Or they could write a simple powershell script that would run on a schedule looking for the access to the drive letter and copy it all as soon as it has access.

My advice would be to set up a hardened Linux virtual machine on a USB stick or hard drive, and run that while you are present in the room. You will need to pause it, and remove the media, taking it with you every single time you leave the room. Do all your work, store all your data on it in truecrypt encrypted volumes, with truecrypt running on the virtual OS, not your machine. Use a virtual keyboard, that is a graphic where you click on the keys, to type in your passwords to defeat any key loggers installed on your physical machine. Never let that USB stick leave your physical presence, even for a minute, and change the passwords on your virtual machine every night using a different computer. It will be a royal pain to do all these measures, however if your situation is this bad and you really need to protect that data then you'll need to keep the discipline.

It would also make sense to change your password on your work computer every day as well. It may not stop them, but at least it may slow them down.

share|improve this answer
    
Thanks. I think the security scheme that u describe provides a good protection to the files but probably not in this particular scenario. "Never let that USB stick leave your physical presence," it would be the more difficult to implement. Altho I think the virtual keyboard is one thing ill try to implement to type part or all the password. –  user1338101 Jan 18 '13 at 22:37
    
I already asked this to christian but I'm asking it to you in case your not following the updates of this question. this could sound foolish but.. I wonder how much protection it'll add if i just follow an advice and work only with a non-administrative rights account and just change it to admin or even log a different admin account just for those situations that I have to. (I don't usually install things in my office so it won't be a big proble for me). That way an average user couldn't install a keylogger, and since the files are encrypted with EFS they can copy them but no open them. –  user1338101 Jan 18 '13 at 22:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.