6

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with each other is by sending text messages (no files) to each other via email - this kind of minimal text-based communication is a necessity.

I will travel a lot and thought about how I could lighten my pack.

Option 1: Since it is easy to swap out the SSD on the more powerful laptop, I could simply carry two SSD drives (one with the secure system and the second one with the less secure system). What I think I know: The two drives share the RAM and the BIOS. They also share the input devices, the display and a number of other hardware modules but I guess that is less relevant here. Did I overlook anything here?

Option 2: Same as option 1 but I would boot into the "secure operating system" from a USB stick while the less secure hard drive is still plugged in. This would be less effort but would it provide the same level of security?

Option 3: Same as option 1 but I would swap out the RAM also.

Option 4: Allow a raspberry pi to use the display and the input devices of my laptop without "getting in contact" with the RAM, the hard drive etc of my Laptop. Is that possible?

My questions are:

a) Is there another option? Which option provides the best balance between security, weight savings and least (one time and ongoing) effort?

b) For the option you would suggest: What are the remaining security holes? How rare/difficult would a successful attack be and how does the security level compare to the existing baseline security (the "secure system" is online and receives text-based emails from the less secure system - I can not change this)?

  • I am aware that technically "best" is subjective but even the word "secure" is subjective if one does not define how to measure "security". I hope this level of subjectivity is appropriate. Otherwise I would ask for alternative options and for the security holes of the different options. – Albert Sep 5 '18 at 15:40
  • Option 4: Install VNC server on the RasPi and VNC client on the laptop. – ThoriumBR Sep 5 '18 at 18:59
  • To address your comment, you can remove a lot of the subjectivity from the word "secure" by having a look at the EFF's article Evaluating your thread model and including answers to those 3 questions in your post here. – Mike Ounsworth Sep 5 '18 at 19:23
  • @ThoriumBR How secure would that be? Le's assume the laptop is full of advanced malware: 1) Occasionally there might be a password in plain text. 2) Also how impossible would it be to use VNC as a channel to transfer malicious data from the laptop to the pi or valuable data from the pi to the laptop? I would be satisfied in this regard if it would be at least as impossible as with the text based Emails I am sending between the two systems. 3) An attacker with control over the laptop could alter what I write for example when I edit a password. Does any of that make sense? – Albert Sep 5 '18 at 19:31
  • @MikeOunsworth Let's do a test run for what the treat model is here. If what I write makes sense I will include it in my original post. Here we go: 1) What am I protecting: Valuable information such as passwords. Uptime (as mentioned in the link you posted) is not a relevant category. 2) Who am I protecting it from: Anybody who is interested in obtaining this information (criminals). I try to defend against attackers who may have control over my main laptop (less secure system) 3) Resources / technical skills: I get around linux well enough for all daily tasks. – Albert Sep 5 '18 at 20:11
3

You could actually do what you proposed, but they are a pain in the ass, Ok, except 2, this is not that big deal and I actually use it as well for carrying portable desktop in hostile environments. The thing is you can do some more things, which, in my point of view, will give you greater flexibility.

  1. Don't get a USB for live boot, get an external hard drive, install an OS normally, encrypt it all and enjoy full functionality (preferentially Linux).

  2. If you get to use a live USB, use an amnesiac OS LIKE Tails Linux and save anything you want directly to an external drive.

  3. Use virtual machines. One laptop, one physical drive. You can choose many different ways to make your host system communicate with a VM and you can also encrypt the vms' virtual drive. That way you can actually choose which will be the secure OS and which will be full of malware (use the VM for that reason - that's how malware analysis is usually done btw). It will save you money and carrying weight.

  4. Get 2 laptops

  5. Make great use of that raspberry you mentioned. I don't know any way you can use your laptops' hardware on you rpi, but you can get a big power back, an external screen and a set of mouse/keyboard and have a very handy and light system ready to roll EVERYWHERE! No joking, this is the best thing i ever created and I'm traveling with this when I know I won't really need my laptop but may need a terminal.

  • Regarding your suggestions: 1) Thought about this as well but couldn't find a security advantage over dual boot with FDE which is lighter and less prone to data loss (cable getting unplugged). 2) What advantage would that have other than privacy? 3) The only secure way in my case to make use of VMs (that I can see) is to have both (the secure and the less secure system) as guests within a secure host. The less secure system is my daily driver so that would be too slow. 4) and 5) make sense security wise but I am looking for something lighter. – Albert Sep 11 '18 at 20:06
  • Im answering your questions the same order you asked in the above comment, so: 1) there won't be any contact with the hard drive. plus, if you partition the drive, the other partition will be visible and able to mount in any case. If someone gains access to the system in one partition they can always mount the other and mitigate, from an external drive thats kind of harder. 2) no actual footprint on your native hard drive 3) too slow depends on your systems resources to "feed" to a vm. 4) get a 11 -13 inch laptop, even refurbished 5) lighter than a rpi? hard. – Chris Tsiakoulas Sep 12 '18 at 10:25
  • In reverse order ;) 5) rpi, screen and peripherals would be ~ 400 grams? 4) I am really trying to optimize for lightness: My laptop is only 1kg lbs to begin with. 2) Excellent point. 1) I would encrypt the disk which has the secure system on it which makes it impossible to mount it from the other system. I guess an attacker could still delete things on the encrypted drive but I am not too worried about this. The attack vectors are the Bios, the bootloader and firmware for the dual boot setup with FDE as far as I can tell. But these attack vectors exist equally for the external drive solution. – Albert Sep 12 '18 at 21:14
  • xD 5) if your laptop is that light, go for option 1 2) i know, i am a red teamer, i always try to avoid disc contact because of av's 1)i think we conclude to a seriously good solution! – Chris Tsiakoulas Sep 13 '18 at 9:14
2

Suggest that you use a Wormhole cable. Benefits include ability to copy & paste, transfer files, and even share keyboard and mouse across macOS, Linux, Windows, Android, and iOS.

Then you can utilize all of the functionality of the malware host without worry about infecting anything else. Maybe use an iPad Pro with LTE and Algo VPN and attach it to a Linux malware analysis lab such as cse-assemblyline.

  • I don't understand the purpose of the cable in the first place since I don't need to transfer files between the two systems. What would be the security advantages vs a simple dual boot on the same hard drive? The cable would provide a bridge for malware to spread from the less secure system to the more secure system if my assumption is correct that I would need to run the secure system unencrypted in order to make use of the cable. Also this solution would require a second device with a screen which would add weight which goes against my goal of making things light. – Albert Sep 9 '18 at 12:22
  • Well, not files, but IoCs and file exploration (file and directory listings) – atdre Sep 9 '18 at 16:24
  • You wouldn’t want to copy and paste MD5s and SHAs? – atdre Sep 9 '18 at 16:24
  • I feel like you didn’t read my answer. First of all, you say that the malware could spread over the cable. How? And why would that matter from a Linux machine to an iOS machine? Secondly, an iPad is pretty much the lightest solution. Other suggestions to use a KVM switch are bulky by comparison. – atdre Sep 9 '18 at 16:27
  • I did read your answer. Maybe I have not understood it fully. Since dual boot with full disk encryption is the lightest option: what security advantage would your suggestion have over dual boot with FDE? – Albert Sep 11 '18 at 19:55
2

Too many questions in one post, so I will just cherry pick a few to answer/comment on.

Option 1: Since it is easy to swap out the SSD on the more powerful laptop, I could simply carry two SSD drives ... Did I overlook anything here?

Maybe you are overlooking some relevant physical security concerns. It is easier to lose the drives if you are just carrying them around with you. It is also easier to drop them, subject them to physical damage if you carry them around not stored snugly in the laptop drive dock.

Option 2: Same as option 1 but I would boot into the "secure operating system" from a USB stick while the less secure hard drive is still plugged in. This would be less effort but would it provide the same level of security?

Be careful when storing critical data on USB Sticks; many USB sticks (the cheaper variety) are very unreliable and can fail at a moments notice.

In addition, if you boot off the USB stick then the original drive is still going to be available as a block device and can be mounted by the OS on the USB stick.

Option 3: Same as option 1 but I would swap out the RAM also.

Swapping out the RAM seems like a real pain in the neck. Also, since RAM is a dynamic memory, you don't really need to swap it out, you can just make sure it is fully powered off for a few minutes and it will not retain information from the previous boot (unless you super-cool it or something).

My questions are:

a) Is there another option? Which option provides the best balance between security, weight savings, and least (one time and ongoing) effort?

Yes, there are many other options.

For example: Use two laptops. For example: Use one laptop running two virtual machines.

b) For the option you would suggest: What are the remaining security holes? How rare/difficult would a successful attack be and how does the security level compare to the existing baseline security (the "secure system" is online and receives text-based emails from the less secure system - I can not change this)?

I think this question is too broad to answer reasonably in a forum such as this.

  • Thanks for taking the time. I know a bit more now: Shared RAM is not a threat. As for loosing the hard drive / USB stick with the secure OS: That would not hurt really because the data is backed up of course. The other options you suggested: 1) Two laptops is what I currently have. 2) Two VMs: If I run the main (less secure) system as the host and the more secure one as the guest then that is not secure enough of course. If I have one virtual machine for each system it's too slow and using USB sticks can be a bit tricky (it's not always clear in Virtualbox which stick is assigned to which VM) – Albert Sep 5 '18 at 19:10
  • You could also dual boot if speed is an issue. The other machine's partition will be visible as a block device, but each could be encrypted. However, you are still better off from a security perspective using two separate laptops. Since you have not really defined what/who you are trying to secure your system against (what kind of attacker) it is hard to give a good answer. No functioning system is ever "fully secure," which is why it is important to define the threat model. – hft Sep 5 '18 at 19:18
  • I had a go at the "threat model" in a comment on the original post above since the treat model question came up there as well. I appreciate your comment there. Since you asked for the "kind of attacker": Is "criminal interested in stealing my information" specific enough? How can one get more specific here? – Albert Sep 5 '18 at 20:15
  • To get more specific, you can specify the powers/access that the criminal is assumed to have. For example, is it someone who would have local access to your machine? (E.g., you are worried someone steals the actual laptop itself?) Or is it a local network attacker who is on your LAN? Or a remote network attacker who would be attacking via open network ports/vulnerable services? – hft Sep 5 '18 at 21:56
  • 1) I would not be worried about someone stealing the laptop since I have backed up the data. But of course I would be worried that someone with physical access steals it AND can access the data. 2) I don't have enough insight to judge whether a local network attack or a remote network attack is more likely / common. I don't have reason to assume that either is more common than the other. 3) What I can say is that I am a bit more concerned with attacks that do not require physical access than with those that do. 4) See also my latest reply to Mike above for more context. – Albert Sep 7 '18 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.