1

One of my friend challenged me that if my laptop is turned on then he can attach a device to it, just like in movies which will copy all data of my computer to his hard drive without touching a single key on my laptop.

My question is that is it possible and even if he gets data from hard-drive can he decode it, and then are there gadgets already there or is it just Film thing... and he is chatting bubbles.

Edit

My laptop is not encrypted with bit locker, but if I do add bit locker, would it be secure enough then ?

1

Yes, it looks possible. I assume you are talking about a USB device.

First, if you have autorun still enabled, the device can present itself as a drive configured for automatically executing the binary that will simply copy all files accessible to it, and maybe try to make a full disk copy.

Then, if you happen to have Windows unpatched, there were some USB driver vulnerabilities out there and exploits for those. Stick a device in and bang, owned.

Regarding the data decoding -- there is not much to decode if one gets a full disk image, he can simply mount it in Linux or whatever.

EDIT: Some CVEs for reference: CVE-2013-1285 CVE-2013-1286 CVE-2013-1287 CVE-2013-3200

And some recreational reading.

4
  • 1
    Similar may be applicable to FireWire, but I don't recall anything published about them. Jul 10 '14 at 13:02
  • 1
    FireWire is actually worse - many laptops for example have direct memory access from FireWire ports! The cure for those at a previous employer was to fill the ports with epoxy!
    – Rory Alsop
    Jul 10 '14 at 13:13
  • 1
    Also who said the USB device cannot also emulate a keyboard and type commands like for example an ftp upload? That thing could type fast as heck. Check out the USB Rubber Ducky from the guys at Hak5 if you are looking for an actual product (and also for some awesome educational video content of course). Jul 10 '14 at 15:12
  • True, this is also a possible attack vector. It shows that possibilities are limitless if one's creative enough. Jul 10 '14 at 16:42
1

What is the challenge here?

Why don't you accept it? Or will you lose your laptop when he succeeds? ;-)

If you have a spare external disk, big enough, give it to him, completely erased and let him do his magic. The disk is yours, stays yours, and of course you want to see if this really works so you don't leave your laptop out of sight. All in all there is no risk that he gets your data.

If your disk is encrypted, and he makes a complete image of the disk, he only gets the encrypted image, which is useless to him.

Please let us know how it all ended!

2
  • Does FDE protect data when the encrypted drive is mounted already and accessible by the logged-in user? It seems the data will be accessible from user mode and from kernel mode as well. Jul 10 '14 at 13:20
  • When the encrypted disk is unlocked, anything that can access and manipulate the CPU or the OS, probably has access to the disk itself.
    – SPRBRN
    Jul 10 '14 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.