1

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is that no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

  • The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
  • When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
  • Malware can only affect an encrypted drive if it is mounted decrypted.
  • If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
  • Methods such as dd are not considered to be part of the threat model.

Note: The use of drive is synonymous with disk for the avoidance of doubt.

Improve this question

1 Answer 1

Reset to default
4

It's protected in the sense that malware cannot be installed on the unmounted encrypted drive. However it's still possible for the encrypted drive to be damaged or destroyed if the drive can be written. A simple dd to the raw unmounted drive can destroy it.

 ----  Edit  ----

If the encrypted drive is a bootable drive, then there is an unencrypted boot partition that could in theory be modified in an "Evil Maid" equivalent.

Improve this answer
13
  • Thanks. I elaborated the question that commands such as dd are not part of the threat model as this resembles wiperware
    – Ryan
    Commented Jan 11, 2020 at 18:43
  • 3
    @Ryan: it is still possible that the malware does not wipe the device but instead encrypts the (already encrypted device) with a key only known to the attacker. While the attacker has no access to the unencrypted data themselves they can still demand a ransom to allow the user access to the drive again. This would not be wiperware but ransomware.
    – Steffen Ullrich
    Commented Jan 11, 2020 at 18:54
  • 1
    @Ben - The reason I ruled out dd is because the data on the disk while sensitive isn't critical for an availability perspective i.e. if data is lost as a result of a disk being wiped, it can be restored from backup.
    – Ryan
    Commented Jan 11, 2020 at 19:24
  • 1
    @SteffenUllrich - Gotcha. If the data is considered to be sensitive but not critical from an availability perspective, would it be fair to state that the risk of a disruptive attack against an encrypted drive such as a wipe or encryption is low or a non-issue? The primary objective is to protect the underlying encrypted files from being compromised or exfiltrated.
    – Ryan
    Commented Jan 11, 2020 at 19:49
  • 1
    @Ryan: "Is forward secrecy an issue with to consider?" - I don't think that this makes any sense in the context of disk encryption since there is no key exchange involved here. But you might check at Cryptography to get better experts about this topic.
    – Steffen Ullrich
    Commented Jan 11, 2020 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .