Re: Re: ecryptfs headsup

[Justin Ossevoort <justin () internetionals nl>]

On 13/07/12 22:13, Dustin Kirkland wrote:
> Yeah, the other thing I'd add is that in order to perform this attack
> (create a filesystem on a USB drive, have physical access to the
> system, plug in the USB drive), the attacking user could just as
> easily drop their favorite LiveISO on that same USB drive, reboot the
> system, and mount the hard drive with root access.  I do see the
> difference, in that the current issue allows for a live attack against
> a running system, as opposed to an offline attack against a system at
> rest.

"Local access" doesn't imply the ability to reboot or interrupt the boot
loader of a machine.
There are some remote desktop/vm like uses (where people can sometimes
plug their own drives) or partially shielded kiosk like machines (where
you can unplug a usb keyboard/mouse).
Also hardened systems with full disk encryption or with a locked bios
which prohibits other boot orders are real targets in this cases.

An online attack is definitely more serious than the known offline
attacks for which most relevant machines are more or less shielded.

Regards,

        justin....