[dm-crypt] Fwd: Practical malleability attack against CBC-Encrypted LUKS partitions

[Milan Broz <gmazyland@gmail.com>]

Below is very nice example of another "Evil maid" type attacks,
here directly applied to LUKS CBC disks.

I think it clearly shows known rule:
If you let your machine out of your sight, it is no longer your machine.

What is important (and blog mentions it)

"It has already been known for a long time that CBC does not prevent
a malleability attack (targeted manipulation of encrypted data) given
that the attacker can modify the ciphertext and knows the corresponding
plaintext as well."

There is no integrity protection in LUKS devices (even cannot be
for transparent disk encryption because there is no additional space
to store integrity checksum / authentization tag data).

Modification (random or malicious) of ciphertext is simply not detectable
on the LUKS/dmcrypt level.

BTW blog doesn't mention that CBC is no longer default mode for cryptsetup
and was replaced by XTS mode.

Milan

> 
> http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/
> 
> I. Abstract
> 
> The most popular full disk encryption solution for Linux is LUKS
> (Linux Unified Key Setup), which provides an easy to use encryption
> layer for block devices. By default, newly generated LUKS devices are
> set up with 256-bit AES in CBC mode. Since there is no integrity
> protection/checksum, it is obviously possible to destroy parts of
> plaintext files by changing the corresponding ciphertext blocks.
> Nevertheless many users expect the encryption to make sure that an
> attacker can only change the plaintext to an unpredictable random
> value. The CBC mode used by default in LUKS however allows some more
> targeted manipulation of the plaintext file given that the attacker
> knows the original plaintext. This article demonstrates how this can
> be used to inject a full remote code execution backdoor into an
> encrypted installation of Ubuntu 12.04 created by the alternate
> installer (the default installer of Ubuntu 12.04 doesn’t allow setting
> up full disk encryption).
> ...