Reputation
265
Top tag
Next privilege 300 Rep.
Create new tags
Badges
1 11
Newest
 Curious
Impact
~5k people reached

Jun
16
comment IPhone iOS 8.3 encryption security against physical access
related question
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
Thanks Eric. It looks like the reason for the discrepancy is that Windows automatically updates the root certificate store as needed.
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
I just confirmed this. Going to hongkongpost.gov.hk/index.html results in Hongkong Post Root CA1 added to the "Trusted Root Certification Authorities".
Feb
12
comment Are there other roots of trust on my computer aside from these 46 root certificates?
Can you tell me exactly where you found the Hong Kong Post office root certificate? I've checked on both my windows 7 and 8.1 machines and haven't found it.
Feb
12
comment Does a valid code signing certificate mean that an installer has not been tampered with in transit?
I'm using a script to automate download and validation, so I suppose I could fairly easily assert that the publisher and chain of trust remain the same. I wonder how consistent the certificates used to sign code actually are from update to update.
Feb
11
comment Does a valid code signing certificate mean that an installer has not been tampered with in transit?
This answer seems to speak to TLS communications. The question is about signed files. Can you explain how this applies to the question?
Nov
27
comment Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?
This question is related to your final question.
Nov
17
comment Accessing iPhone data without passcode - how difficult?
Can you give an example of how insecure boot could result in accessing user data without a passcode on modern iOS? Ostensibly, decrypting user data requires the passcode regardless of malicious boot code.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
Interesting. It looks like a high-entropy key is derived algorithmically from, in part, the passcode. However, this is done in a separate chip containing and using a unique ID. This arrangement complicates performing an offline brute-force attack and limits the online attempt rate. See my answer for more details.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
The second bullet surmises that the key can be algorithmically derived from the passcode. It seems plausible that instead, while the device is locked, a high-entropy key is stored only in a "trusted" area of hardware (a la bitlocker PIN+TPM), and that key is unlocked with the passcode. The premise in that case is that the key is much more difficult to exfiltrate from the "trusted" area of hardware than brute-forcing the 4-digit password after dumping the plain-old flash.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Also, do you have a source supporting the general availability of RdRand to Hyper-V guests? Ostensibly, not all VMWare guests have access to RdRand. It seems like the same might be true for Hyper-V.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Do you have a source for your point (4)? The link you provided does not support it.
Mar
17
comment When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
Thanks for the great answer. I'm not grokking your last paragraph, though. What do you mean by "internal encryption"?
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
'performing the attack' would work just as well for my purposes. I've been hunting for an image of the "specially prepared USB drive" apparently used in the article, without success. I'd like to attempt the attack in the article, but without an image that is pretty tough.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
As we established in the question's comments, this doesn't answer my actual question. The paper is on point, and is a decent survey of plausible attack strategies. However, it only confirms what I already understood: Boot path tampering is detectable by the user when using Bitlocker with "PIN + TPM". My original question of how to simulate such boot path tampering for testing, however, remains.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
@BobWatson I think you've found the root of our miscommunication. Thanks for that. Indeed, I am specifically interested in "'Evil Maid Attack' boot path tampering" (à la the question's title) not every possible flavor of 'Evil Maid Attack' of which there are many, as you have commented.
Feb
13
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
"You're asking to protect yourself in the case where you're leaving your machine unattended." I didn't ask that. With respect, I'm not really interested in opinions about the likelihood of surreptitious replacement of my motherboard. I'm actually interested in an answer to my original question.
Feb
13
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
Thanks @BobWatson. I have seen that argument advanced before. It seems to lump all forms of physical access threats together. In particular, it dismisses the idea of protecting against boot path tampering because a hardware key logger could be installed. Personally, I don't follow that argument: I can disassemble my laptop and fairly confidently rule out the existence of a hardware key logger, so why shouldn't I use a TPM to rule out the existence of a boot-path key logger?
Feb
2
comment VM hypervisior that doesn't leak that it's a VM to the guest?
@TomLeek +1 "mostly because there is no equality between skills at assembly system programming, and capacity to explain things to other people with pedagogy and serenity"
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
+1 for point about clearing cookies