Date: Fri, 18 Nov 2016 14:58:26 +0000 From: Jason Cooper <osssecurity@...edaemon.net> To: oss-security@...ts.openwall.com Cc: john.haxby@...cle.com Subject: Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup Initrd root Shell Hi Jacobo, On Thu, Nov 17, 2016 at 07:54:20PM -0500, Jacobo Avariento wrote: > Actually when using full disk encryption, to lock the BIOS and GRUB must > be mandatory, otherwise you are protecting your confidentiality but not > your integrity. Even with a password in GRUB with an unprotected BIOS > you can also boot from a USB device and access encrypted partitions, > delete them, etc. As long as the user in conscious of the threat model and makes the deliberate decision, this is fine. But please always advise folks, "Physical access trumps everything. Period." I can't count the number of hard drives I've pulled and cmos' I've reset. That why I always advise moving all of the unencrypted boot material (bootloader, /boot, LUKS header) to a separate thumbdrive and to boot via USB. Maintaining physical custody of the boot material keeps it more secure and is easier for the user because there are fewer passwords involved. And, with UEFI, you can update/configure it from within the OS, which means the password for that can be kept in a password manager on the encrypted volume. thx, Jason.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.