Slashdot Mirror
Bootkit Bypasses TrueCrypt Encryption
mattOzan writes with this excerpt from H-online: "At Black Hat USA 2009, Austrian IT security specialist Peter Kleissner presented a bootkit called Stoned which is capable of bypassing the TrueCrypt partition and system encryption. The bootkit uses a 'double forward' to redirect I/O interrupt 13h, which allows it to insert itself between the Windows calls and TrueCrypt."
So yeah, if someone is running live software on your machine then there isn't much you can do. If there is decrypted data then it's essentially available to anything on the machine.
I mean if you're going to do this you could just modify the TrueCrypt code (bootloader in this case) itself to do what you want.
Kind of "duh" story if you ask me.
The ratio of people to cake is too big
TFA has a very good point -- unless you (cryptographically) trust the components of your system all the way down to the hardware itself, you can get pwned by an attack like this. You can regularly do all-the-way-to-the-firmware scrubs of your machine as damage-control, but the only real prophylactic is some form of trusted computing.
Of course, I'm not really dying to jump on the TPM bandwagon, given the sponsors, but it sure would be nice if there was an openly-audited trusted computing module.
If someone can gain physical access to your machine then it's effectively game over.
If that was the case, what would be the point of disk/partition encryption in the first place?
Is this type of attack only limited to trucrypt or can it affect other product?
From what I understand it could potentially affect other products unless they (properly) use TPM to avoid this kind of attack by checking MBR against a checksum.
is there a way to prevent it?
Get a mac! Not trolling, from TFA: "The attack is unsuccessful when the BIOS successor the Extensible Firmware Interface (EFI) is at work on the motherboard." AFAIK Apple are the only vendor using EFI on their entire range at the moment. I guess mounting everything read-only, or using a BSD with the file immutable bit set on all system files would work too.
If all else fails, immortality can always be assured by spectacular error.
I'm not so sure a mac is the answer. With a mac, you can just install the code in the keyboard and grab the keys directly.
You're absolutely right. Strangely, none of those links led to Peter Kleissner's web page.
Check out the comments. Some of the visitors are flaming him pretty hard, but he's just a kid with amazing skills and (understandably) very little historical knowledge. Luckily, Christian politely points out that his attack serves to "... alert many people who think they made their PC secure by installing TrueCrypt and still keep working with an admin account where they should not. You prove that a security policy is indispensable, because admin privileges will give malicious software the ability to tamper with the installed security software."
This exploit really is more comparable to a software keylogger. It lies between OS and Truecrypt Bootloader, catching the disk access requests.
For infection, you need admin rights on the running machine (TFA says so).
So, with the full system encryption, you are of course safe. This is just a way of listening to Truecrypt requests.
Kudos to Peter, hope to meet him in the Metalab sometime.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Encryption is to prevent your data from escaping if someone stole your laptop. It however will NOT prevent the thief from installing a keylogger(which is what TFA is basically describing) which can then be used to discover your passphrase and eventually gain access to the system.
If you lose a laptop and then recover it, you can be fairly certain that your data was never leaked but you cannot be certain that someone didn't tamper with your system so they could steal the data later. At that point the best you could do would be mount the volume on a completely different system and move any data you hadn't already backed up, then wipe the drive/bios fully..though after yesterday's article about the BIOS "rootkit" that is Computrace, I'd be wary of the hardware at that point.
0x09F911029D74E35BD84156C5635688C0
Things like encryption are to protect against normal problem, like losing a device with important data, not to protect against a determined adversary that wants your particular stuff.
For example I have an encrypted USB stick who's function is to hold my passwords, in particular the ones I don't use a lot. It is a USB stick, since I don't want to keep something like that on my computer which is always networked. While I think I have good security, there's always a chance someone owns my computer and I don't notice. So, best not to keep passwords on it. It is encrypted in case I ever lose it, or it gets stolen. That way, the person who has it can stumble across the password text file.
That is what it is to protect against: Normal ways that someone might happen across my passwords. It is not a protection against everything. If someone really wanted my passwords, they could just hold a gun to my head, I'd give them what they wanted. Nothing I have is worth dying for. As such, no amount of protection would keep it safe. I don't bury my key in a hidden location, I don't keep its existence a secret, etc. Reason is none of that would matter since anyone willing to go to the lengths necessary to get at it, would be willing to go to the lengths to get at me and make me give up my passwords.
Full disk encryption isn't for universal protection, it is for protection against laptop theft. For example at work we used to have an idiot in charge of, among other things, issuing codes for the doors. Our doors have electronic keypad locks as well as physical locks. Ok so idiot didn't keep this data on the central servers. He didn't trust it there. He instead kept it on his laptop. Well, his laptop then got stolen, and the data wasn't encrypted. That was a lot of fun, we got to change all the door codes. Had he encrypted his disk, this wouldn't have been a problem. The crook wasn't trying to get our door codes, they were just stealing a laptop.
You replied, off-topic, to the first off-topic post, which was also a troll, over ten minutes after this and this top-level ones, which coincidentally say the exact same thing as yours.
It didn't take ten minutes to type that, didn't it?
It's really sad that your karma whoring works.
Just boot from a CD rom. Infact forget the hash, just boot from the truecrypt rescue disk every time which restores your MBR.