Tag Info

Hot answers tagged

9

Forgive me, but the #1 solution for a real-time dependent system is to not let undesignated junk run on it. Users shouldn't be browsing the Internet with an RTOS setup. That needs to stop yesterday. At least in good theory, Deep Freeze type systems will protect your computer from any permanent modification. They intercept all write activity and remap it. ...


7

Best option is just to encrypt the Linux partition, e.g. with LUKS. That way the Windows 7 partition can't actually access any of the data on the other partition. Technically it can still read and write to the partition (there's no way to prevent this) but the data it sees is all encrypted.


6

This is exactly the problem that Secure Boot was created to solve. The problem is that if you don't have a chain of trust going all the way back to POST, then you can't guarantee that there hasn't been tampering. (And even then, "guarantee" is an exaggeration). You can checksum the boot partition at startup; perhaps use the checksum as part of the key for ...


5

The TPM doesn't stop the boot. The boot will still continue, but the PCRs will have a different value in them than they used to (since now the BIOS is different than it was before). As a result, the system will be unable to unseal the sealed data. Of course, if the bootloader or kernel is unable to unseal the sealed partition, depending on how it is ...


5

You're very wrong in your last assumption; full disk encryption is not "possible to circumvent with relative ease". It is especially not "possible to circumvent with relative ease" to reach the goal of this workaround IF you're behaving securely. As you've probably figured out by now, this is a physical-access problem. If somebody has physical access to ...


4

BIOS Most memory chips I've worked with have a W or R/W pin which selects the write mode. Physically tying that one to appropriate logical level should do the trick. Write-protected USB drives I'm a bit suspicious about this one. I've implemented microcontroller<->SD card interface, and the "write-protect" bit is handled completely in software, so you ...


4

Before we talk about the single user mode, let's talk about what you can do when you have physical access (in the context of your question, of course). On MAC, the first thing to boot from another media (LiveCD, USB stick, etc.) and navigate to /var/db/dslocal/nodes/Default/users and modify root.plist and disable the password. On Linux, I'd do the same with ...


4

It's complicated. Both are Root of Trust for Measurements meaning they can be used to measure the running environment. The main problem with SRTM is that you need to keep measurements of the entire platform boot sequence (BIOS config, 3rd party boot rom (e.g. network cards), etc) and this includes a LOT of code. Any change to any of this requires new ...


4

The "right way" to protect boot code on an embedded device is to load from a ROM: it should be hard to modify the boot sector. Even without a true ROM, most flash devices I've seen have a lock sequence you can write from within the flash driver. This makes the device harder to overwrite (not impossible, say by a targeted attack) -- preventing garden variety ...


4

This depends what you mean by “the overall concept of secure boot”. Pretty much all secure boot systems have several components, starting with one in ROM and ending with an operating system or even programs within that operating system. A typical boot chain is ROM → OEM bootloader → OS bootloader → OS kernel → OS startup programs. A typical secure boot ...


3

Corruption is an act of Evil perpetrated by Bad People. You discovered that when you download things "off the Internet", you sometimes don't obtain the genuine thing. If you need medication, do you go to the pharmacy, or will you prefer something sold by a shifty-looking guy in a back alley ? Don't you believe that inoculating yourself with substance of ...


3

The attack you describe sounds more like a "diamond heist" attack of sorts (a bit elaborate for the everyday criminal). Before I address UEFI, I wanted to answer if that is feasable. No, not really. If we are talking about a server running a VM, the end user may not notice a performance issue (given enough physical resources) but more than likely the ...


2

This is using Trusted Platform Module to defeat the Evil Maid Attack. In short this is to insure that your bootloader hasn't been tampered with, which could undermine an encrypted file system.


2

There are some variables to take into account. First of all it's not trivial to just access the Linux partitions. Mainly because, natively, Windows does not support ext3 or ext4 which are used to install Linux on. Without these drivers it's impossible to access the drives. Malware will, normally, not have onboard read/write drivers for these filesystems. ...


2

Bitlocker is vulnerable to much the same attack. This paper describes an attack against the PIN: "At the next boot, the MBR boot loader loads this file and transfers control to it. A fake BitLocker prompt is displayed (see figure 1); the entered PIN is stored in the NTFS partition, the original MBR is restored and the system rebooted. Later, the entered PIN ...


2

The top security concern is that the only protection of traditional PXE booting is physical security. There is no encryption or authentication anywhere in the process from power-on to OS start. The basic PXE process: Computer makes a DHCP request DHCP server responds with address and PXE parameters Computer downloads boot image using TFTP over UDP The ...


2

In a PXE environment, as a pentester, I have 2 major classes of attack I can choose from. 1: I can capture a full machine image. Do your systems automatically connect to the domain controller after setting up the machine? If so, this image probably has domain controller credentials on it, that I can capture and use elsewhere. 2: I can manipulate images on ...


1

Yes, that will do the trick just fine. Another option is to use shred, in your case shred -n 1 -v /dev/sdX (one pass, and enable verbosity to see the progress). Note that both of these solutions won't work against a BadUSB-infected flash drive, since BadUSB turns the flash drive into an arbitrary device, usually a keyboard (that types shell commands in ...


1

The implementation of PXE in a corporate environment may raise concerns about security. This document shows why these concerns are mostly unfounded. http://www-01.ibm.com/support/docview.wss?uid=swg21247020 EDIT: I'd like add that PXE is only a part of the provisioning equation then talking about the "security of the provisioning equation" and ...


1

(Quick answer, I don't have the time to research all I remember and double-check my facts.) There are multiple things to consider here: USB sticks may carry payload that you do not know is there, e.g. a virus to infect the computer it's plugged in to. Things like BIOSes, network cards, etc. can often be flashed to upgrade the firmware. You could also ...


1

In the United States, the validation (certification) you looking for in government and some regulated areas is listed in the NIST Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules list. Per the FIPS 140-2 standard tamper based requirements start at Level 2. FIPS 140-2 Security Level 2: Security Level 2 enhances the physical security mechanisms ...


1

If you google for secure flash drive you will find a few. There aren't many that are commercially available that will do exactly what you want though. Have a look at http://www.secureusb.co.uk/index.php?route=product/category&path=35&gclid=CNTh9e3ykbACFYt-fAodn2Ojqg



Only top voted, non community-wiki answers of a minimum length are eligible