oss-sec mailing list archives
Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup Initrd root Shell
From: Jason Cooper <osssecurity () lakedaemon net>
Date: Fri, 18 Nov 2016 14:58:26 +0000
Hi Jacobo, On Thu, Nov 17, 2016 at 07:54:20PM -0500, Jacobo Avariento wrote:
Actually when using full disk encryption, to lock the BIOS and GRUB must be mandatory, otherwise you are protecting your confidentiality but not your integrity. Even with a password in GRUB with an unprotected BIOS you can also boot from a USB device and access encrypted partitions, delete them, etc.
As long as the user in conscious of the threat model and makes the deliberate decision, this is fine. But please always advise folks, "Physical access trumps everything. Period." I can't count the number of hard drives I've pulled and cmos' I've reset. That why I always advise moving all of the unencrypted boot material (bootloader, /boot, LUKS header) to a separate thumbdrive and to boot via USB. Maintaining physical custody of the boot material keeps it more secure and is easier for the user because there are fewer passwords involved. And, with UEFI, you can update/configure it from within the OS, which means the password for that can be kept in a password manager on the encrypted volume. thx, Jason.
Current thread:
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell, (continued)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Leo Famulari (Nov 14)
- Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Hector Marco (Nov 15)
- Re: Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Jeremy Stanley (Nov 15)
- Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Hector Marco (Nov 15)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 16)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 16)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jacobo Avariento (Nov 17)
- Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 18)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 16)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Leo Famulari (Nov 14)