1

I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the files? I think it doesn’t encrypt the /bios partition - is that a problem? I’ve seen some articles about some Evil Maid attack as well?

Improve this question
1
  • 1
    If it is off and stays off then a brute force attack (against the master key or Chris Garcia himself) is the only option. If it is on and you enter(ed) your password then there are more options. In the linked related threads you'll find some relevant discussions.
    – secfren
    Mar 25 at 16:40

2 Answers 2

Reset to default
0

If the attacker has physical access to your PC they can:

  • Implant a HW keyboard logger and you're completely compromised.
  • Alter the initrd (inital ramdisk) - the so called Evil Maid attack and implant any malware.
  • They can potentially alter your UEFI firmware and implant undeletable malware which cannot be detected by your OS.

If you're concerned about this, the best protection would be do use Apple hardware, i.e. MacBook or certified Google Chromebooks. They have protections against 2 and 3, but 1 is still possible though extremely complicated.

Improve this answer
12
  • 2
    "It fully protects against " Proofs? For some 2+3 protection Linux also has some options (Secure Boot, UKI, Heads,...)
    – secfren
    Mar 25 at 21:24
  • @secfren UKI is not implemented in any existing stable released distro yet, Fedora 38 is not yet released. Apple has the strongest all around HW protection of any personal hardware out there. That's a bloody fact. Most x86 motherboards happily allow to flash whatever crap you come up with. That's impossible with Apple where every piece of software if signed and cannot run unless the hardware allows it.
    – Artem S. Tashkinov
    Mar 25 at 22:38
  • I can give you a password protected MacBook and you're welcome to subvert its boot process. Meanwhile at Pwn2Own 2023 fully updated Ubuntu was hacked 5 times. Only a single attack against MacOS was demonstrated. Nothing for iOS.
    – Artem S. Tashkinov
    Mar 25 at 22:44
  • Speaking of the boot process for MacBooks. Please peruse support.apple.com/en-us/guide/security/secac71d5623/web x86 UEFI PC is a joke in this regard. BTW, Chrome Books are also very well protected. Actually it's worth adding to the answer.
    – Artem S. Tashkinov
    Mar 25 at 22:49
  • 1
    "That's impossible" - Sure? tbh, I am not aware of any current public ways to subvert MacOS early during the boot process. Though there have been some public ones in the past. Problem with those "secure" devices is you throw away lots of security via telemetry and with a deeply locked down system in case of an successful attack the protection will be used against the user. Locking down, in the way Apple does, also makes security research harder for researchers on a budget (those with bigger budgets remaining).
    – secfren
    Mar 25 at 23:54
0

You can encrypt the /boot partition with LUKS1 and thus protect initial ramdisk and kernel image from tempering. It requires GRUB2.

I don't think vanilla Ubuntu installation can set this up (I wouldn't trust Ubuntu for managing my security anyway).

But, I have never looked into the security implication of using LUKS1 over LUKS2. And even though, attack surface is limited, GRUB2 might have vulnerabilities too prior to decryption.

Of course that does not protect against hardware tempering or firmware tempering for example.

Some documentation: https://wiki.archlinux.org/title/Dm-crypt/Specialties

My opinion is that disk encryption is only good to encrypt data at disk in case the disk (computer) is stolen.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .