1

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard disk using for example Keybase's code signing mechanism for directories (I know there are lots of issues here, just bear with me for a second) would this a reasonable method to know that no digital keyloggers or other malicious software are installed? Of course it would not resolve the issue that if (for example) I leave my computer in my hotel room someone may install a physical keylogger or other malicious device in the hardware itself, but I would know for example that none of the data on my computer was tampered with or altered.

Some other issues with this approach are that it would take a long time to compute the signature of literally every file on your computer, and also that in the general scheme of things actually using your computer, the size and contents of files (esp. system files) can change at any time behind the scenes.

Improve this question
4
  • Would a hash work just as well? You could hash the entire contents before you are away from your computer then verify when you get back?
    – schroeder ♦
    Commented Jul 22, 2014 at 22:49
  • Theoretically hashing would work, but then a hacker could simply replace the hash. Perhaps hash + signature?
    – Jason
    Commented Jul 22, 2014 at 23:02
  • You store the hash outside of the computer (email?). Signing performs a hash, then applies your personal key to the hash so that a recipient knows that you are the owner of the contents and the hash. I'm not sure what you gain by adding a Digital Sig.
    – schroeder ♦
    Commented Jul 22, 2014 at 23:16
  • BTW just checked, hash + signature is how keybase does directory signing / verification
    – Jason
    Commented Jul 22, 2014 at 23:16

2 Answers 2

Reset to default
1

My suggestion, if permitted in the country you are traveling to (there may be some export control issues, depending on the destination), full disk encryption (FDE) would be the way to go. Without the master password, no alterations can be made to the encrypted portion of the disk. This will not protect you from physical tampering of your device, as you mentioned, but seems to meet your requirements to prevent someone from installing a digital keylogger. Plus, prevention is a lot more secure than detection. Just make sure the device is completely powered down when not in use.

There would be a small risk, as the boot portion of the drive would have to remain unencrypted... there could be some attack vector utilizing that, but it would require money, skill and determination to pull off without detection (if they overwrite the wrong byte, you drive isn't booting up). So for the average person, the risk is minimal someone will go through that much effort.

EDIT: Another risk to consider, FDE would not help if someone exploited your PC over a network, and managed to get a keylogger running in memory. Make sure your PC is fully patched, have a host firewall installed/enabled, anti-virus installed, ect. It's not perfectly secure, but it helps mitigate the risk.

Improve this answer
0

Tripwire is one of the software perfectly answering to your need.

By the way, it is also usefull to detect misbehaving OS or software installers (the one which unwillingly let admin file with write access all over the FS). The evil may also come from inside :[.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .