0

I have physical access to a Linux computer (Ubuntu 20.04). My colleague asked me what an attacker could do if he had physical access to this computer?

I would like to know if, by default (after a fresh installation), it is possible to plug a USB into the computer and steal data (the computer is always running)?

Otherwise, what other malicious things could an attacker do?

7
  • To clarify, the prerequisite is that the attacker cannot reboot the computer?
    – user284677
    Nov 3, 2022 at 9:23
  • The computer can be rebooted by the attacker Nov 3, 2022 at 9:33
  • Have you password protected the grub menu?
    – user284677
    Nov 3, 2022 at 9:35
  • It said a clean install, thus no grub password protected menu.
    – Jeroen
    Nov 3, 2022 at 9:47
  • 1
    @Jeroen if such a strict definition of "fresh install", then is there any data to steal?
    – schroeder
    Nov 3, 2022 at 9:48

3 Answers 3

2

This depends on the level of hardening. Having physical access to a Linux server generally means one is able to reboot it.

Next, when the Grub screen appears select "Advanced options". At this point you can edit the commands by pressing "e".

Find the line that starts with "Linux" and change the read only mode to read write mode. At the end of the line add init=/bin/bash

By pressing F10, you should be in a terminal. At this point you only need to mount the root file system in read/write mode:

mount -n -o remount,rw /

Now type passwd and enter a new root password, reboot the machine and use the new root password for full access.

I would like to know if, by default (after a fresh installation), it is possible to plug a USB into the computer and steal data

Yes, if the server has USB ports, it certainly is possible to plugin a USB device. However, stealing data requires access to at least the terminal with root privileges, which can be obtained as described above.

4
  • Thank you for this answer. But if the machine has no keyboard/mouse but only USB ports (we can only plug USB keys and nothing else), is it not possible to steal data or something else ? I read about DMA attack (the theory) but I didn't find any recent example on a Linux machine with USB interfaces. Nov 3, 2022 at 10:03
  • @PoubelleDirty How do you maintain/configure the server if you have no keyboard? Remotely?
    – user284677
    Nov 3, 2022 at 10:18
  • Yes remotely with SSH Nov 3, 2022 at 10:20
  • How do you protect against plugging in a USB keyboard? The reason I ask is that you could use USB keys that emulate as a keyboard.
    – Jeroen
    Nov 3, 2022 at 13:59
2

what other malicious things could an attacker do?

Since there isn't any security measure in place the answer is a lot.

The simplest thing is rebooting the system and gaining root access (as described by @Jeroen). This is the oldest trick in the book. After an attacker gains root privileges, then it's free rein for them.

Advanced attacks are also possible (depending on whose target you are), such as the evil maid attack and in some cases installing hardware keyloggers.

Keep in mind that physical access to an asset from an adversary is considered the worst scenario for security because there are unlimited things to do in order to circumvent any protection measures - from installing cameras to keyloggers to stealing the computer itself.

EDIT:

But if the machine has no keyboard/mouse but only USB ports (we can only plug USB keys and nothing else), is it not possible to steal data or something else?

Even though more complicated, because it requires some knowledge of the system (e.g. account credentials, where your data is located etc), it is still possible to steal data by only plugging in a usb device. There's the USB keystroke injection attack, in which a usb drive can pose as a keyboard to the OS and run commands (see for example rubber ducky). It is much more difficult to execute due to the amount of info a person requires in order for the attack to be successful, but it is an applicable attack.

1

While there will be trade offs of time, access, and resources; the short answer is Complete Compromise.

Your title says SERVER, so it's reasonable to assume disk encryption is not a factor as servers are rarely encrypted due to the need to be able to auto restart without manual intervention.

Depending upon other unstated parameters:

  • Complete drive-to-drive imaging can be performed in a few hours.
  • An external network tap can be inserted. (Is there a network?)
  • Open it up and insert an internal tap
  • Open it up and insert another drive to be retrieved later?
  • Install remote access code.

There are many other possibilities that trade time and convenience, but complete compromise is possible, it just may be slow or fast depending on practical restrictions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .