RE: Laptop Security - Microsoft EFS
From: Jason Coombs (jasonc@science.org)Date: 09/06/02
- Previous message: Daniel R. Miessler: "RE: ISA firewall"
- Maybe in reply to: Bryan Allerdice: "RE: Laptop Security - Microsoft EFS"
- Next in thread: Anthony V. Teelucksingh: "RE: Laptop Security - Microsoft EFS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Jason Coombs" <jasonc@science.org> To: "Burton M. Strauss III" <bstrauss3@attbi.com>, <security-basics@securityfocus.com> Date: Fri, 6 Sep 2002 09:42:48 -1000
In the case of a laptop where the biggest concern is theft, you make a good
point. Since the laptop is gone, the attack option of installing a Trojan or
otherwise tampering with the device so that it behaves maliciously at a
later time when it is under the authentic user's control just doesn't work.
A stolen laptop that is later recovered is more dangerous than one that
never shows up again because you'll be tempted to trust it and make use of
it, but it must never be used by anyone ever again because it can never be
proven secure. Extracting data from its hard drive and then throwing it in
the garbage or selling it to somebody who doesn't need security may be the
only options, given the impossibility (today) of proving that chips on the
motherboard haven't been replaced with malicious replicas.
As for EFS key theft, that wasn't the point I was trying to emphasize -- the
fact that EFS gives any regular software access to encrypted data through
automatic decryption when the encryption key is online means that the Trojan
doesn't have to concern itself with the key or the decryption, it can just
wait for the user to login and provide the decryption key, after which time
there is effectively no barrier to access to the encrypted data. The user
doesn't have control over key use in EFS, it's all-or-nothing and fully
automatic. For real security when the decryption key is online there needs
to be human intervention and authorization during each key use.
Sincerely,
Jason Coombs
jasonc@science.org
-----Original Message-----
From: Burton M. Strauss III [mailto:bstrauss3@attbi.com]
Sent: Friday, September 06, 2002 5:12 AM
To: security-basics@securityfocus.com
Cc: jasonc@science.org; Bryan Allerdice
Subject: RE: Laptop Security - Microsoft EFS
I think you're right but wrong...
Ultimately, the data has to be decrypted to be used, and at that time it's
vulnerable. It may require admin access to the box, or custom hardware, but
at SOME POINT in the chain it has to be decrypted. It's classic - don't
crack the encryption, stick a sniffer in there AFTER it's decrypted.
EFS has the added security of a second factor, namely the key (or recovery
keys) that have to be provided once you have physical access! So it's
CERTAINLY better than just a raw file system.
With EFS the key(s) are unique to the drive. If the key (or recovery key)
is compromised, well, you don't need anything else beyond physical access
(mount the hd in a box you control, and use the key). Recovery agents don't
change this, they just give more keys that have to be secured and thus form
an additional point of attack -- one that may not make evident the ultimate
target.
Without the key(s), you need a trojan to steal it. To install a
key-trapping trojan, you need admin access to the box, so you've already
compromised one of the factors.
Ultimately we're back to the ultimate vulnerability in ANY scheme - where
having (logical|physical) access to a non-tamper-(proof|resistant|evident)
system is the problem.
-----Burton
-----Original Message-----
From: Jason Coombs [mailto:jasonc@science.org]
Sent: Wednesday, September 04, 2002 2:07 PM
To: Bryan Allerdice; security-basics@securityfocus.com
Subject: RE: Laptop Security - Microsoft EFS
One of the things I was dissatisfied with when reviewing EFS was that it
only works for encrypting user data. Although programs installed by the user
for the user can also be encrypted, conceivably, it isn't possible to use
EFS to encrypt system files. So EFS prevents user data from being copied in
cleartext during a mount attack, but the easiest way for an attacker to gain
access to the contents of the encrypted files is to install a Trojan on the
drive during the mount attack and then put the drive back where the attacker
found it. When the user logs in, the Trojan will have access to the EFS key
if it's online, and can immediately access the plaintext of each encrypted
file. If the EFS key is not online, the Trojan has to wait for it to become
available -- which happens when the user accesses any encrypted file ...
thus giving the Trojan complete access to every file. The EFS key isn't
stored temporarily in process memory, it's cached for use during the entire
session (until the user logs out) by any code that tries to access encrypted
files.
Somebody tell me if my analysis was wrong.
Sincerely,
Jason Coombs
jasonc@science.org
- Previous message: Daniel R. Miessler: "RE: ISA firewall"
- Maybe in reply to: Bryan Allerdice: "RE: Laptop Security - Microsoft EFS"
- Next in thread: Anthony V. Teelucksingh: "RE: Laptop Security - Microsoft EFS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
