5

I'm writing a story where a security expert has been kidnapped and tasked with gaining access to some files on a stolen computer protected by full-disk encryption, and I'd like some ideas for ways he might accomplish that. The encryption is software-based, and the character has physical access to the entire computer.

The people that kidnapped the character don't know who has the encryption key, so the $5 wrench method is out. The computer has not seen use for a very long time, and is only used occasionally (on the scale of once every couple of years), so introducing a keylogger or some other method that relies on capturing user input to find the key won't be useful. The character knows that he's going to be killed if he doesn't manage to get access to these files, so he's pretty motivated to try anything that might work, even if it would ordinarily be too tedious or fiddly to bother with. He has about a week to produce results.

The computer in question is an alternate-universe system basically equivalent to a 1998 PC, running the fantasy equivalent of Linux. The character is attempting to break into it with roughly 2008-level technology. He definitely doesn't have access to enough computing power to brute force the key in a reasonable amount of time.

So, what are some approaches the character might take? From what I've read about full-disk encryption, cold boot attacks are a method for breaking it if you have physical access to the machine, but since this one hasn't been used in a long time I don't believe that's an option.

  • 1
    This question is more suited to worldbuilding, but put aside the fantasy factor, the character is pretty much dead. Without evil maid attack, no cold boot, on a computer rarely used and powered off, the easiest method I can think of is bruteforce. But if someone used FDE back in 2008, the password is not trivial, and with 2008 tech it will take more than a week to bruteforce a key. The other approach would be finding a vulnerability on the encryption system and exploit that, but it could take more than a week. Did the char looked under the keyboard? Usually the password is there. – ThoriumBR Oct 29 '17 at 15:36
  • 1
    The expert might vaguely remember that the full-disk encryption software vendor has built in backdoors in the past and may try to find one of them. Also, crypto implementation errors aren't too uncommon. Or, maybe some else has previously installed a hardware keylogger in the keyboard and your expert is the one discovering it by accident? – Arminius Oct 29 '17 at 15:56
2

In 1998, DES3 was still considered to be a standard for security (fips 46-3 wasn't withdrawn until 2005). But it was already crackable by brute force within days. Your problem however is access to computing resource - if the gun were pointing at my head, my next thought would be to look at a way of distributing the operation via javascript from a busy site...

However if the gun were pointing at my head, then the first thing I'd do is check for post-it notes. The next place I would think to to look for a way into a machine which probably hadn't been patched for 10 years is a vulnerability database - security tools don't have a good security record.

  • That's interesting to know about DES3! I think the computing resources would be a problem, yeah. I think exploiting some kind of vulnerability in the security software is the solution that would make the most sense. – kelind Oct 30 '17 at 11:05
1
  1. If it's used that rarely, then the password must be written down, or easily memorable to the owner of the computer. If it's the latter, then it may be guessable if you know the identity of the owner. If it's the former, look for the bit of paper hidden somewhere.
  2. If it's rarely used, then the keys on the keyboard should be fairly clean. Do some keys have smudges of dirt where the owner has typed their password? This won't be enough by itself, but it limits the guesses needed.
  3. Is the password checking algorithm flawed? For instance does it reject a password that is wrong in the first character a few microseconds quicker than a wrong last character? If so, then the expert can guess the password one character at a time.
  • Oh man, I hadn't even considered the keyboard! I'm not sure whether it would work in this scenario, but it would definitely be a great detail to add. – kelind Oct 30 '17 at 11:16
  • @kelind There's a well-known trick with regularly used keypads to look for the most worn buttons. But that wouldn't work here. So I tried shining a torch at an angle onto the keyboard of my old netbook PC. It's old and rarely used, but has a replacement keyboard with no signs of wear. Sure enough, there was a greasy mark on the first letter of my password. – Simon B Oct 30 '17 at 17:02
1

There are a number of factors that could make this possible.

  • If the whole disk that is encrypted is a) bootable & b) a known OS & Version then there are known locations containing known files with a reasonable file size.
  • Given a limited number of possible encryption technologies and that the password prompting must be unencrypted you could fingerprint that section, (after either removing the drive or booting from an external drive), to know which encryption program was used and from that further limit the range of ciphers, (possibly down to one).
  • Possible plot cheap trick the software &/or organisation password rules may severely limit the number of possible passwords and the cracker may know these rules, (I have worked at places that had a fixed length for passwords and a set of case and content rules that conflicted with the encryption software password rules to the point where there were only a few tens of thousands of possible passwords I'm not saying where).
  • As others have stated if the machine is used only once or twice a year then the password must be memorable.

The combination should make a rules based dictionary attach doable within the timescale.

  • 1
    I think exploiting knowledge of the OS and version on the machine is definitely the way to go, thanks! – kelind Oct 30 '17 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.