1

I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible threats are if I would only log out of my Ubuntu session. I know, that an Ubuntu password can be reset easily when there is no home folder encryption (what I don't have because I already use luks), but for that case it would be necessary to restart the system and unlock the luks.

Of course, the security would depend on my Ubuntu password then, but are there known vulnerabilities to hack a logged out session? I guess one would say, its always safer to shut down the system so have the full luks security, but whats the actual risk?

| improve this question | |
  • LUKS keys are flushed when you luksClose/detach the volume. Not present in RAM (intentionally, at least). Modified-to-log binaries are then your only concern, so who has root? – user2497 Jan 5 '18 at 7:42
  • I don't understand your comment, Iam talking about logout of a Ubuntu session, so not detaching or closing a disk? What do you mean with modified to log binaries? – Jekoula Jan 6 '18 at 20:37
  • so no detach? Root or sudo-anything users could access it. Keys in RAM, probably not in cleartext though. – user2497 Jan 6 '18 at 20:38
  • what kind of detach you are asking for? why shoudl someone have root access to my computer? Iam not talking about a server, just a personal computer.. – Jekoula Jan 6 '18 at 20:42
  • luksClose just detaches the cryptodisk (see in /dev/mapper). Forget luksClose. Yes, you can leave your cryptodisk mounted if you want. Disconnect network connections if you are worried. – user2497 Jan 6 '18 at 20:48
2

If you are using any type of pre-boot /OS level, or per-mount encryption it usually keeps anything protected accessible until you shut down. If you log out, but the system still needs access to application that would otherwise be encrypted that means the data can still be accessed and that it is either decrypted or that the decryption key is still in memory. Session management is usually disconnected from file encryption.

This means that if you had malware running on your system and it was not tied to your user session, it would continue to run even when you are logged out.

From your OP it sounds like you are talking about physical access attacks. If you can connect the locked system to a network or use a usb device which is masquerading as a ethernet controller it may be possible to spoof your real network and to carry out attacks. A good example is PoisonTap.

PoisonTap produces a cascading effect by exploiting the existing trust in various mechanisms of a machine and network, including USB/Thunderbolt, DHCP, DNS, and HTTP, to produce a snowball effect of information exfiltration, network access and installation of semi-permanent backdoors.

There are other similar implementation, such as Rob Fuller's and BadUSB. You can use an app like USBGuard to prevent these.

Hypothetically, an attacker may also be able to install a more basic keylogger that you may not notice and then they can obtain your password to your session this way with physical access. There have also been live physical memory dumping attacks in the past and new ones may be discovered.

As a result, if you are in an untrusted environment in terms of physical access you should do a full shutdown to prevent any access to encrypted data. See also this post on the topic.

| improve this answer | |
  • Regarding installing a keylogger: are you just talking about hardware keyloggers? Then there is no difference to a Laptop that has been shut down. – Jekoula Jan 6 '18 at 20:01
  • In the linked post there is said "they can dump your entire disk unencrypted", thats a point I didn't express in my question yet, but in my understanding that is very hard to do, because the system is running and the disk is connected, so how to dump the data unencrypted? Is it really possible somehow? – Jekoula Jan 6 '18 at 20:04
  • @Jekoula (1) hardware keylogger (2) Yes, moreso your RAM/memory than your hard drive/storage. If you can also write memory you can give the OS arbitrary instructions to copy the hard drive. Another link: makezine.com/2008/03/04/ram-dump-over-firewire – Eric G Jan 6 '18 at 20:45
0

Aria's suggestion of a cold-boot attack had slipped my mind, and is the better answer (most immediately threatening) IMHO.

For completeness though, another issue is that while generally a lot of effort goes into securing the OS (kernel and software running on it), no-one is perfect. By booting and unlocking the computer, you are making the un-encrypted disk / data available to the software running on it. If there is a flaw in some of that software, it can be exploited to gain access to the un-encrypted data.

| improve this answer | |
-1

There's possibility of cold-boot attack.

https://en.wikipedia.org/wiki/Cold_boot_attack

| improve this answer | |
  • 3
    Please do not post link-only answers. Include the relevant parts of the link in your answer. – schroeder♦ Jan 2 '18 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.