How secure is my logged out but not shut down luks HD

Question

I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible threats are if I would only log out of my Ubuntu session. I know, that an Ubuntu password can be reset easily when there is no home folder encryption (what I don't have because I already use luks), but for that case it would be necessary to restart the system and unlock the luks.

Of course, the security would depend on my Ubuntu password then, but are there known vulnerabilities to hack a logged out session? I guess one would say, its always safer to shut down the system so have the full luks security, but whats the actual risk?

Answer 1

If you are using any type of pre-boot /OS level, or per-mount encryption it usually keeps anything protected accessible until you shut down. If you log out, but the system still needs access to application that would otherwise be encrypted that means the data can still be accessed and that it is either decrypted or that the decryption key is still in memory. Session management is usually disconnected from file encryption.

This means that if you had malware running on your system and it was not tied to your user session, it would continue to run even when you are logged out.

From your OP it sounds like you are talking about physical access attacks. If you can connect the locked system to a network or use a usb device which is masquerading as a ethernet controller it may be possible to spoof your real network and to carry out attacks. A good example is PoisonTap.

PoisonTap produces a cascading effect by exploiting the existing trust in various mechanisms of a machine and network, including USB/Thunderbolt, DHCP, DNS, and HTTP, to produce a snowball effect of information exfiltration, network access and installation of semi-permanent backdoors.

There are other similar implementation, such as Rob Fuller's and BadUSB. You can use an app like USBGuard to prevent these.

Hypothetically, an attacker may also be able to install a more basic keylogger that you may not notice and then they can obtain your password to your session this way with physical access. There have also been live physical memory dumping attacks in the past and new ones may be discovered.

As a result, if you are in an untrusted environment in terms of physical access you should do a full shutdown to prevent any access to encrypted data. See also this post on the topic.

Answer 2

Aria's suggestion of a cold-boot attack had slipped my mind, and is the better answer (most immediately threatening) IMHO.

For completeness though, another issue is that while generally a lot of effort goes into securing the OS (kernel and software running on it), no-one is perfect. By booting and unlocking the computer, you are making the un-encrypted disk / data available to the software running on it. If there is a flaw in some of that software, it can be exploited to gain access to the un-encrypted data.

Answer 3

There's possibility of cold-boot attack.

https://en.wikipedia.org/wiki/Cold_boot_attack