[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5003CB29.2090001@internetionals.nl>
Date: Mon, 16 Jul 2012 10:04:57 +0200
From: Justin Ossevoort <justin@...ernetionals.nl>
To: oss-security@...ts.openwall.com
Subject: Re: Re: ecryptfs headsup
On 13/07/12 22:13, Dustin Kirkland wrote:
> Yeah, the other thing I'd add is that in order to perform this attack
> (create a filesystem on a USB drive, have physical access to the
> system, plug in the USB drive), the attacking user could just as
> easily drop their favorite LiveISO on that same USB drive, reboot the
> system, and mount the hard drive with root access. I do see the
> difference, in that the current issue allows for a live attack against
> a running system, as opposed to an offline attack against a system at
> rest.
"Local access" doesn't imply the ability to reboot or interrupt the boot
loader of a machine.
There are some remote desktop/vm like uses (where people can sometimes
plug their own drives) or partially shielded kiosk like machines (where
you can unplug a usb keyboard/mouse).
Also hardened systems with full disk encryption or with a locked bios
which prohibits other boot orders are real targets in this cases.
An online attack is definitely more serious than the known offline
attacks for which most relevant machines are more or less shielded.
Regards,
justin....
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
