Comment by segfaultbuserr | Hacker News Reader

Comment by segfaultbuserr | Hacker News Reader

Parent Full thread

In this case, just "rm" everything is far from enough, it needs to be a secure deletion. And the best way to implement secure deletion is using full disk encryption, this way, instead of wiping the entire disk, you just need to wipe the header, which contains its master key.

    head -c 100000000 /dev/zero > /dev/sdX1; sync

An even better solution is interfacing the motherboard with a small microcontroller and storing the master key in hardware (and possibly with a key-split algorithm, so compromising the hardware doesn't reveal the key, but its destruction will kill the key), such as a battery-backed SRAM or a hardware crypto chip. The self-destruction command would be an I/O request to wipe the chip. Tamper-switches can be placed at strategic physical locations around the machine.

You can also write a deamon to monitor USB devices and trigger the self-destruction when an unknown device is detected, e.g. If your machine has been seized on-the-fly, the attacker is likely to plug an anti-screenlock USB mouse emulator, which triggers its self-destruction.

The tricky part is balancing the degree of security protection and the risk of data destruction from a false-positive trigger...

What's wrong with using FDE and entering the key manually on startup? You could then just shut down when you detect suspicious behavior and all is well or am I missing something?

It depends on your threat model. The OP mentions bobby traps and self-destruction, so I assume the threat model here is not a typical model in personal computing, but a different one, which is similar to Dread Pirate Roberts' threat model, as explained below.

Self destruction has two advantages, comparing to shutting down the system. First, once the encrypted master key in the header has been wiped, the data is gone, it's technically impossible to recover the data anymore (your passphrase is only the key to decrypt the master key in the header). On the other hand, revealing the passphrase under pressure is always a possibility. Second, when an attacker tries to seize your system, a possible strategy is seizing your system alive in a surprise attack, giving you no chance to shut the system down, and using an USB mouse emulator to defeat the screenlock.

And the reason of using a hardware-backed key storage, is to prevent the clone of the encryption header (which makes the self-destruction useless), and to ensure the destruction of the key is complete. In modern SSDs, due to wear levelling, there's no guarantee that the physical sector the header belongs to is actually erased.

No need for a booby trap. Some guy tried to do that akin from the scene in Mr.Robot with limited success using thermix. The only success was using a shape charge inside a desktop, but that is not possible on a laptop.

I like the idea of a USB dongle that is attached to the person which immediately locks the computer and erases the drive but the problem is that it takes time and law enforcement can just remove the battery to stop the erase (if battery is easily accessible).

Erasing the headers on an encrypted drive seems quick and effective and the way to proceed. But if the technique is to use a USB dongle then we should also be able to modify the source code of Suicide Linux to do the same with the modified default terminal.

> And law enforcement can just remove the battery to stop the erase

This is why full disk encryption should be used.

> Erasing the headers on an encrypted drive seems quick and effective and the way to proceed. But if the technique is to use a USB dongle then we should also be able to modify the source code of Suicide Linux to do the same with the modified default terminal.

Defense-in-depth, you add a bit of countermeasures at every level. For example, the USB self-destruction will immediately kick in (if the law enforcement decides to seize the computer alive, a mouse emulator is likely to be used immediately), erase the header, and halt the computer, even before anyone has a chance to perform any forensics. If the LE was able to take the computer to a lab, it's possible to do a live memory extraction via cold-boot attack while the computer in still running, for example.

Again, the tricky part is balancing the sensitivity of the self-destruction mechanism and the risk of data destruction from an accidental trigger... A possible workaround is adding an "armed" switch - the most sensitive tamper-detection code is only activated after the switch is flipped if the perceived risk is high, for example, before you take your laptop to a coffee shop.

Is it possible to find the sourcecode?

Edit: found it

https://github.com/tiagoad/suicide-linux

Reply on news.ycombinator.com