242 reputation
18
bio website
location
age
visits member for 2 years, 4 months
seen 2 hours ago

Nov
27
comment Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?
This question is related to your final question.
Nov
17
comment Accessing iPhone data without passcode - how difficult?
Can you give an example of how insecure boot could result in accessing user data without a passcode on modern iOS? Ostensibly, decrypting user data requires the passcode regardless of malicious boot code.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
Interesting. It looks like a high-entropy key is derived algorithmically from, in part, the passcode. However, this is done in a separate chip containing and using a unique ID. This arrangement complicates performing an offline brute-force attack and limits the online attempt rate. See my answer for more details.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
The second bullet surmises that the key can be algorithmically derived from the passcode. It seems plausible that instead, while the device is locked, a high-entropy key is stored only in a "trusted" area of hardware (a la bitlocker PIN+TPM), and that key is unlocked with the passcode. The premise in that case is that the key is much more difficult to exfiltrate from the "trusted" area of hardware than brute-forcing the 4-digit password after dumping the plain-old flash.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Also, do you have a source supporting the general availability of RdRand to Hyper-V guests? Ostensibly, not all VMWare guests have access to RdRand. It seems like the same might be true for Hyper-V.
Mar
11
comment Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?
Do you have a source for your point (4)? The link you provided does not support it.
Mar
17
comment When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
Thanks for the great answer. I'm not grokking your last paragraph, though. What do you mean by "internal encryption"?
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
'performing the attack' would work just as well for my purposes. I've been hunting for an image of the "specially prepared USB drive" apparently used in the article, without success. I'd like to attempt the attack in the article, but without an image that is pretty tough.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
As we established in the question's comments, this doesn't answer my actual question. The paper is on point, and is a decent survey of plausible attack strategies. However, it only confirms what I already understood: Boot path tampering is detectable by the user when using Bitlocker with "PIN + TPM". My original question of how to simulate such boot path tampering for testing, however, remains.
Feb
14
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
@BobWatson I think you've found the root of our miscommunication. Thanks for that. Indeed, I am specifically interested in "'Evil Maid Attack' boot path tampering" (à la the question's title) not every possible flavor of 'Evil Maid Attack' of which there are many, as you have commented.
Feb
13
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
"You're asking to protect yourself in the case where you're leaving your machine unattended." I didn't ask that. With respect, I'm not really interested in opinions about the likelihood of surreptitious replacement of my motherboard. I'm actually interested in an answer to my original question.
Feb
13
comment Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
Thanks @BobWatson. I have seen that argument advanced before. It seems to lump all forms of physical access threats together. In particular, it dismisses the idea of protecting against boot path tampering because a hardware key logger could be installed. Personally, I don't follow that argument: I can disassemble my laptop and fairly confidently rule out the existence of a hardware key logger, so why shouldn't I use a TPM to rule out the existence of a boot-path key logger?
Feb
2
comment VM hypervisior that doesn't leak that it's a VM to the guest?
@TomLeek +1 "mostly because there is no equality between skills at assembly system programming, and capacity to explain things to other people with pedagogy and serenity"
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
+1 for point about clearing cookies
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
Thanks @Rello3oT. That pretty well amswers mu question. I'd like to vote your answer up, but apparently my rep is too low.
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
How apparent is throttling? Should I be able to detect it without tools?
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
Aren't there other legitimate and less apparent ways than CAPTCHAs to protect against brute force attacks?
Aug
9
comment How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
I assume you are referring to the Mat Honan reference. Clearly you didn't read my question carefully as I do not imply or state that Mat Honan was the target of a brute force attack.