oss-sec mailing list archives
Re: Re: ecryptfs headsup
From: Justin Ossevoort <justin () internetionals nl>
Date: Mon, 16 Jul 2012 10:04:57 +0200
On 13/07/12 22:13, Dustin Kirkland wrote:
Yeah, the other thing I'd add is that in order to perform this attack (create a filesystem on a USB drive, have physical access to the system, plug in the USB drive), the attacking user could just as easily drop their favorite LiveISO on that same USB drive, reboot the system, and mount the hard drive with root access. I do see the difference, in that the current issue allows for a live attack against a running system, as opposed to an offline attack against a system at rest.
"Local access" doesn't imply the ability to reboot or interrupt the boot loader of a machine. There are some remote desktop/vm like uses (where people can sometimes plug their own drives) or partially shielded kiosk like machines (where you can unplug a usb keyboard/mouse). Also hardened systems with full disk encryption or with a locked bios which prohibits other boot orders are real targets in this cases. An online attack is definitely more serious than the known offline attacks for which most relevant machines are more or less shielded. Regards, justin....
Current thread:
- Re: ecryptfs headsup, (continued)
- Re: ecryptfs headsup Tyler Hicks (Jul 10)
- Re: ecryptfs headsup Dustin Kirkland (Jul 11)
- Re: ecryptfs headsup Kurt Seifried (Jul 11)
- Re: Re: ecryptfs headsup Tyler Hicks (Jul 11)
- Re: Re: ecryptfs headsup Kurt Seifried (Jul 11)
- Re: Re: ecryptfs headsup Tyler Hicks (Jul 11)
- Re: Re: ecryptfs headsup Dustin Kirkland (Jul 13)
- Re: Re: ecryptfs headsup Jason A. Donenfeld (Jul 13)
- Re: Re: ecryptfs headsup Jason A. Donenfeld (Jul 14)
- Re: Re: ecryptfs headsup Sebastian Krahmer (Jul 16)
- Re: Re: ecryptfs headsup Justin Ossevoort (Jul 16)