What can an attacker do with physical access to a Linux server?

Question

I have physical access to a Linux computer (Ubuntu 20.04). My colleague asked me what an attacker could do if he had physical access to this computer?

I would like to know if, by default (after a fresh installation), it is possible to plug a USB into the computer and steal data (the computer is always running)?

Otherwise, what other malicious things could an attacker do?

Answer 1

This depends on the level of hardening. Having physical access to a Linux server generally means one is able to reboot it.

Next, when the Grub screen appears select "Advanced options". At this point you can edit the commands by pressing "e".

Find the line that starts with "Linux" and change the read only mode to read write mode. At the end of the line add init=/bin/bash

By pressing F10, you should be in a terminal. At this point you only need to mount the root file system in read/write mode:

mount -n -o remount,rw /

Now type passwd and enter a new root password, reboot the machine and use the new root password for full access.

I would like to know if, by default (after a fresh installation), it is possible to plug a USB into the computer and steal data

Yes, if the server has USB ports, it certainly is possible to plugin a USB device. However, stealing data requires access to at least the terminal with root privileges, which can be obtained as described above.

Answer 2

what other malicious things could an attacker do?

Since there isn't any security measure in place the answer is a lot.

The simplest thing is rebooting the system and gaining root access (as described by @Jeroen). This is the oldest trick in the book. After an attacker gains root privileges, then it's free rein for them.

Advanced attacks are also possible (depending on whose target you are), such as the evil maid attack and in some cases installing hardware keyloggers.

Keep in mind that physical access to an asset from an adversary is considered the worst scenario for security because there are unlimited things to do in order to circumvent any protection measures - from installing cameras to keyloggers to stealing the computer itself.

EDIT:

But if the machine has no keyboard/mouse but only USB ports (we can only plug USB keys and nothing else), is it not possible to steal data or something else?

Even though more complicated, because it requires some knowledge of the system (e.g. account credentials, where your data is located etc), it is still possible to steal data by only plugging in a usb device. There's the USB keystroke injection attack, in which a usb drive can pose as a keyboard to the OS and run commands (see for example rubber ducky). It is much more difficult to execute due to the amount of info a person requires in order for the attack to be successful, but it is an applicable attack.

Answer 3

While there will be trade offs of time, access, and resources; the short answer is Complete Compromise.

Your title says SERVER, so it's reasonable to assume disk encryption is not a factor as servers are rarely encrypted due to the need to be able to auto restart without manual intervention.

Depending upon other unstated parameters:

• Complete drive-to-drive imaging can be performed in a few hours.
• An external network tap can be inserted. (Is there a network?)
• Open it up and insert an internal tap
• Open it up and insert another drive to be retrieved later?
• Install remote access code.

There are many other possibilities that trade time and convenience, but complete compromise is possible, it just may be slow or fast depending on practical restrictions.