2

Having a LUKS Full Disk Encrypted Linux installation means that I need to input my decryption password before the Operating System can even start.

This will require me to use a hardware keyboard on the machine.

Now, if I have a portable installation of a Linux distro, can adding a software keyboard that shows up right with the decryption password prompt be more secure when using on foreign hardware, instead of using the untrusted hardware keyboard?

How would that add to security?

i.e. does LUKS password have to be stored anywhere, like say in RAM, as long as the OS is in use? And if I'm using my own Operating System as said earlier, can this password, if stored anywhere, be stolen by this foreign hardware?

3
  • By software keyboard do you mean something that automatically types that password or a keyboard that pops up and you click the keys? Jul 23 '16 at 19:37
  • A keyboard that pops up and I click the keys.
    – Mars
    Jul 23 '16 at 19:45
  • since any input can be stored, it's all about obscurity in this realm.
    – dandavis
    Jul 25 '16 at 15:35
1

Most “keyloggers” are in fact general spyware that detect many things other than key presses and are not at all fazed by on-screen keyboards. But such a keylogger would be software running in the operating system. It's possible to store malware in the computer's firmware, but that's a rather advanced threat; while malware in the firmware of many peripherals can access the RAM, figuring out what the software is doing from outside the OS is difficult. This being said, once someone has written the software, anyone can run it, so it's easy to spread software attacks.

So relying on an on-screen keyboard does reduce the risk of a keylogger attack when running an OS you control on hardware that you don't fully trust. It doesn't eliminate it, however. Using hardware that you don't trust also has the problem that you can't know that it's really executing your program. It would certainly be possible to write spyware that analyzes the OS on your drive a bit and invisibly injects itself into it.

If you really don't trust the hardware, don't use it, period.

If you kind-of trust the hardware, then you can reduce but not eliminate the risk by reducing the hardware attack surface. Eliminating the keyboard is an advantage in at least one situation: in a cybercafé-type environment, when you trust the administrator of the machines but you fear that someone will perform a discreet modification such as inserting a hardware keylogger into the keyboard. Still, once the software for the attack has been packaged, it's easy to insert a piece of hardware that's actually a USB hub with the attacker's hypervisor, causing your OS to run inside the attacker's hypervisor and thus exposed to the attacker's spyware. You're just requiring the attacker to be a bit more sophisticated.

Once again, the only way to have confidence in a computer is to trust its hardware. If you don't trust the hardware, you can't trust any software that runs on it.

0

This would be mildly helpful and help defend against lots of hardware keyloggers, however there are some that take into account mouse data, this is however harder to use and requires some resources. Additionally hardware mouse loggers are rather uncommon. However if someone with significant knowledge and resources has access to the hardware you are using and they really want to do bad things to you then they will. In short, yes, it is mildly safer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.