1

We use LUKS/dm-crypt encrypted workstations with long passwords.

But if an laptop is unlocked and booted into Debian, using Xscreensaver then the disk is in an unencrypted state but the keyboard is locked.

My question is, would it be possible to with full physical local access, on a normal laptop to bypass the screensaver and enter the OS as the logged in user?

The scenario would be someone stealing the laptop that has FDE but the user being logged on and the screen locked (lid-closed default state)

I guess for example that one could use advanced hardware techniques such as Fault Injection, but there might be other ways to force entry?

Another follow up question is how to protect a laptop from physical access without turning it off or otherwise severely affecting boot-up time to continue working, for example in a café/train enviroment.

1 Answer 1

-1

If someone targets you specifically and has full physical access to the device, you're screwed. They can install a hardware keyboard logger, they can install a DMA PCI-E device and have full access to your RAM at all times. They can install a bridge for your display and get all your video output. It's near impossible to defend against such attacks unless all your hardware is digitally signed.

I'm aware of the only company which does that and that's Apple. Their Mac laptops are extremely well protected (to the point where you cannot install third party components). You still need to consult with Apple how well it all works. Of course we are talking about MacOS, not Linux.

Then there is a cold boot attack which allows in some cases to extract your encryption keys and decrypt all the info on your laptop. Some new enterprise Intel and AMD laptops have full RAM encryption to thwart such attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .