[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20161118145826.GA2799@io.lakedaemon.net>
Date: Fri, 18 Nov 2016 14:58:26 +0000
From: Jason Cooper <osssecurity@...edaemon.net>
To: oss-security@...ts.openwall.com
Cc: john.haxby@...cle.com
Subject: Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup
Initrd root Shell
Hi Jacobo,
On Thu, Nov 17, 2016 at 07:54:20PM -0500, Jacobo Avariento wrote:
> Actually when using full disk encryption, to lock the BIOS and GRUB must
> be mandatory, otherwise you are protecting your confidentiality but not
> your integrity. Even with a password in GRUB with an unprotected BIOS
> you can also boot from a USB device and access encrypted partitions,
> delete them, etc.
As long as the user in conscious of the threat model and makes the
deliberate decision, this is fine. But please always advise folks,
"Physical access trumps everything. Period."
I can't count the number of hard drives I've pulled and cmos' I've
reset. That why I always advise moving all of the unencrypted boot
material (bootloader, /boot, LUKS header) to a separate thumbdrive and
to boot via USB.
Maintaining physical custody of the boot material keeps it more secure
and is easier for the user because there are fewer passwords involved.
And, with UEFI, you can update/configure it from within the OS, which
means the password for that can be kept in a password manager on the
encrypted volume.
thx,
Jason.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
