Hacker News Reader

Comment by tptacek | Hacker News Reader

Things like this are a reason I unhesitatingly recommend that people stick with their OS's built in FDE:

1. FDE is extremely limited. This particular attack is a clever abuse of sleep/reboot cycles, but of course people intimately familiar with FDE know that if a laptop is sleeping but not shut down it's already perilously close to the boundary at which FDE breaks down. And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off.

2. When flaws like this are found, the OS vendors have much more recourse than third parties do, which is why this post concludes by saying that Macs are now the most secure laptop platform with respect to DMA attacks against FDE.

Use FDE! Enable it on all your machines! But try not to rely on it, and don't waste too much time optimizing it.

View on HN

I don't know about Apple but Microsoft has a pretty nasty way of handling user's Bitlocker keys.

If you use a Microsoft account, your key is automatically backed-up in Microsoft's cloud. Red flag #1.

Also, as the recent Bitlocker bypass "bug" showed us, Microsoft has some way of bypassing Bitlocker encryption when it performs updates on the system. I don't know if they have some kind of key escrow or what, but either way - red flag #2.

Of course, I'd say the bigger problem is that Microsoft doesn't even give the majority of Windows users the option to encrypt their computers, by restricting Bitlocker to expensive computers and Windows licenses, while every other operating system does. So the advice to "just use the built-in FDE" doesn't work for the majority of Windows users.

A PC + "expensive Windows professional license" is still cheaper than a Mac.

This is not really relevant to the discussion, or even fully accurate. Most people who buy windows licenses (including me) buy one of the base licenses because we generally don't need the other "professional" features on our home computers.

You can optionally store your FDE key on Apple's iCloud, but Apple makes it extremely clear what it is doing and offers to let you do so or not do so.

Right-o about using the built in FDE. It's kind of funny to think about how many lay users walk around thinking their laptop is safely protected by a password.

My girlfriend was shocked at how easily I was able to "hack" her laptop and reset the forgotten password by changing whatever accessibility.exe to cmd.exe.

It is possible to suspend Bitlocker. This works by writing the key somewhere on the disk. Then when you reenable it the key is removed again. This is necessary if you normally store the key in the TPM chip and you're going to do something that will break its trust, like updating the BIOS.

The recent update would suspend Bitlocker during the installation which is not a nice thing to do automatically.

It doesn't mean Microsoft has the keys though.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off.

I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no?

For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with a thief accessing my customer's source code.

Even though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the (https://en.wikipedia.org/wiki/Cold_boot_attack). The method from the article only removes the need to physically remove and cool the memory chips.

Ok, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?

Apple wants the computer to be able to wake up on its own in order to fetch new emails and such. Just a few minutes ago, I used Screen Sharing to connect to my sleeping MacBook from another room to check for updates based on this article's recommendation. Quite convenient, but it does imply that the OS keeps the keys around.

I'd bet that if you turn all that stuff off, they keys are scrubbed. That could be a good compromise instead of turning the computer completely off all the time.

My understanding is that it is configurable on macOS by enabling destroyfvkeyonstandby.

https://derflounder.wordpress.com/2014/02/12/power-nap-power...

Sleep does not shuts down ram.

There are no memory chips to remove on recent Macs, making this attack much harder if not impossible to perform.

Macs still have memory chips, even if they are not removable. This can be attacked by using specialized hardware which you press onto the RAM chips’ connectors. The inability to remove RAM is not meant as a security feature, and therefore gives no significant protection against a motivated attacker with specialized hardware.

Assume that there are generally two kinds of physical attackers:

* Casual, opportunistic attackers who will steal any available laptop.

* Targeted attackers who want your laptop in particular.

Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped.

Against a targeted attacker, like the FBI when they took down Ross Ulbricht (who FDE'd his laptop), the attacker will simply wait until the laptop is unlocked.

I was curious about that, so I looked it up. Pretty interesting stuff.

[0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Road employee "cirrus" — initiated a chat with Ulbricht, requesting that he log in to Silk Road's back end to fix a technical problem. As soon as Der-Yeghiayan could confirm that Ulbricht was logged into the site, FBI agents entered the library.

Two plainclothes FBI agents, one male and one female, walked up behind Ulbricht and began arguing loudly. This staged lovers' tiff caught Ulbricht's attention long enough to distract him from his laptop. As soon as Ulbricht looked up, the male agent reached down and slid the computer over to his female colleague, who quickly snatched it up and handed it over to Kiernan for further investigation."

[0] http://www.businessinsider.com/ross-ulbricht-will-be-sentenc...

If they made a movie about Snowden, they will surely made a movie about this.

Yup: http://www.theverge.com/2016/10/14/13290460/coen-brothers-si...

American Greed episode on Silk Road:

http://www.cnbc.com/live-tv/american-greed/full-episode/silk...

There was a similar, bar less dramatic, case in the UK recently - where police swiped the phone from the hands of a suspect as he took a call, and then kept interacting with the screen to keep it unlocked long enough to recover the evidence required.

In retrospect, it's a pretty obvious attack vector.

A dead man's switch with a very short time-out would make that kind of attack a lot harder.

For the extremely security-conscious, it could even be a kind of fail-deadly (https://en.wikipedia.org/wiki/Fail-deadly) feature that wipes the phone.

See, this is the problem with people's conception of FDE. This is actually a very silly solution to the problem.

The right approach is to recognize what FDE is good at (minimizing the risk that casual thieves will get data in addition to valuable parts, and protecting computers that can frequently be powered all the way off from even advanced attackers), and then use something better to protect sensitive data.

https://github.com/hephaest0s/usbkill Checks for changes with USB drives and shuts down the computer and optionally deletes files and wipes ram. USB stick on a wristband > unplugs when they take the computer > shuts down

>the attacker will simply wait until the laptop is unlocked.

A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself.

Does anyone know of such a solution?

A screen saver (w/ require password & possible full hibernation with memory flush)?

That's defeated by a USB mouse jiggler [1], which is apparently commonly used by the type of people who seize computers in the wild.

[1] https://www.amazon.com/CRU-Inc-30200-0100-0011-WiebeTech-Jig...

Yes, my idea was a intension counter measure to 'mouse' jigglers.

I think they are talking about a system that unconditionally asks for the password every 10 minutes even while the computer is in active use.

> Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no?

The Windows lockscreen has had a law enforcement backdoor since at least Windows XP. This effectively makes FDE worthless on Windows if you only put your computer to sleep instead of a full shutdown.

Reply on news.ycombinator.com