1

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard disk using for example Keybase's code signing mechanism for directories (I know there are lots of issues here, just bear with me for a second) would this a reasonable method to know that no digital keyloggers or other malicious software are installed? Of course it would not resolve the issue that if (for example) I leave my computer in my hotel room someone may install a physical keylogger or other malicious device in the hardware itself, but I would know for example that none of the data on my computer was tampered with or altered.

Some other issues with this approach are that it would take a long time to compute the signature of literally every file on your computer, and also that in the general scheme of things actually using your computer, the size and contents of files (esp. system files) can change at any time behind the scenes.

  • Would a hash work just as well? You could hash the entire contents before you are away from your computer then verify when you get back? – schroeder Jul 22 '14 at 22:49
  • Theoretically hashing would work, but then a hacker could simply replace the hash. Perhaps hash + signature? – Jason Jul 22 '14 at 23:02
  • You store the hash outside of the computer (email?). Signing performs a hash, then applies your personal key to the hash so that a recipient knows that you are the owner of the contents and the hash. I'm not sure what you gain by adding a Digital Sig. – schroeder Jul 22 '14 at 23:16
  • BTW just checked, hash + signature is how keybase does directory signing / verification – Jason Jul 22 '14 at 23:16
1

My suggestion, if permitted in the country you are traveling to (there may be some export control issues, depending on the destination), full disk encryption (FDE) would be the way to go. Without the master password, no alterations can be made to the encrypted portion of the disk. This will not protect you from physical tampering of your device, as you mentioned, but seems to meet your requirements to prevent someone from installing a digital keylogger. Plus, prevention is a lot more secure than detection. Just make sure the device is completely powered down when not in use.

There would be a small risk, as the boot portion of the drive would have to remain unencrypted... there could be some attack vector utilizing that, but it would require money, skill and determination to pull off without detection (if they overwrite the wrong byte, you drive isn't booting up). So for the average person, the risk is minimal someone will go through that much effort.

EDIT: Another risk to consider, FDE would not help if someone exploited your PC over a network, and managed to get a keylogger running in memory. Make sure your PC is fully patched, have a host firewall installed/enabled, anti-virus installed, ect. It's not perfectly secure, but it helps mitigate the risk.

0

Tripwire is one of the software perfectly answering to your need.

By the way, it is also usefull to detect misbehaving OS or software installers (the one which unwillingly let admin file with write access all over the FS). The evil may also come from inside :[.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.