Re: [dm-crypt] encrypted root: prevent / detect tampering with kernel / initrd

[Olivier Sessink <oliviersessink@gmail.com>]

Arno Wagner wrote:
> On Tue, Dec 29, 2009 at 11:52:37PM +0100, Olivier Sessink wrote:
>> Arno Wagner wrote:
> [...]
>>> But here is something easy: Use an external boot medium for  
>>> verification, e.g. a memory-stick installed Knoppix with some
>>> custom check script you call manually or automatically. Keep the 
>>> external checker system separate from the laptop. With
>>> that the ideas you outlined above would work. You can, e.g.,
>>> compary MBR and files in /boot to checksums or good copies.
>>> I currently have an 8GB SuperTalent Stick with the Knoppix
>>> DVD installed on it in my vallet. Adding packages and your own
>>> data/programs is possible as it has a writable filesystem (writes get 
>>> ovelayed on top of the read-only DVD image).
>> I am aware of this concept, but it just moves the problem to the usb  
>> image (somebody sneaks into your hotel room at night ....). And again if  
>> somebody did change the usb image there is no way you are going to find  
>> out, even if they did something that could have been detected very  
>> easily such as a changed initrd. I don't expect our "regular users" to  
>> carry a very good safe with them day and night (and a safe can be picked  
>> as well).
> 
> Simple again: Wear it on a chain around your neck.
> Anybody that can beat this likely can beat any and all
> other security measures you can implement.

we're talking "regular users" here. You know, the ones that write
passwords on pieces of paper even if you tell them not to write
passwords ever down. So these users are quite a weak link in the
security. So we do the best we can do that is acceptable for the
end-user, and will likely work with our end-users. I think they will
laugh very hard if we tell them to wear a memory-stick around their
necks.. It won't work. They will leave it on their hotel room or in
their luggage.

Olivier