security

Why disk-encryption is not only useful for paranoid computer geeks

According to this (German) spiegel.de article, thieves have stolen a hard drive from the recording studio of the quite popular German band Rosenstolz.

Among the contents of the drive are unreleased songs from the past six years and two songs which should be released on a new single in a few weeks. Apparently those two songs on the drive were the only instance they had, off-site backups only contained older "beta" versions of the songs. As the band is touring at the moment (i.e. no time for re-recording the songs), it's unclear whether the single can be released in time.

Lessons learned:

  • Backups, backups, backups!
  • Disk-encryption is not only for paranoid computer geeks, but also for normal people like you and me[1]. Really! If that hard drive would have been encrypted they would still suffer because of the lack of good backups, but at least their unreleased songs wouldn't have fallen in the hands of the thieves. I bet those songs will soon appear in P2P networks around the globe[2].

(via Fefe)

[1] Well, I am a paranoid computer geek, and I'm probably not a normal person, but you get the point ;-)
[2] Oh, and if the thieves are stupid enough they will get caught while uploading the files ;-)

HOWTO: Disk encryption with dm-crypt / LUKS and Debian [Update]

A few weeks ago I published a small HOWTO for using loop-aes to encrypt your hard drive, usb thumb drive etc.

As I have bought a new 300 GB external USB disk drive on Friday, I have tried something new this time: disk encryption using dm-crypt / LUKS. It has been suggested to me multiple times that dm-crypt is superior to loop-aes, however I didn't get a real reason. Yes, it doesn't require any kernel patches and is easier to setup. But has any serious cryptographer looked at it sharply, yet? Did it withhold his eye contact?

Anyways, here's how I encrypted my 300 GB drive. I largely followed the guide at the EncryptedDeviceUsingLUKS wiki page...

  1. Make sure you run Linux 2.6.16 or better. Previous versions suffer from an implementation problem which affects the security of dm-crypt, see Linux Kernel dm-crypt Local Cryptographic Key Disclosure.
  2. Enable the following options in your kernel:

    • Code maturity level options
      • Prompt for development and/or incomplete code/drivers
    • Device Drivers -> Multi-device support (RAID and LVM)
      • Device mapper support
      • Crypt target support
    • Cryptographic options
      • AES cipher algorithms
  3. Overwrite the whole drive with random data in order to slow down attacks on the encryption. At the same time perform a bad blocks scan to make sure the hard drive is not going to die too soon:
    badblocks -c 10240 -s -w -t random -v /dev/sdb
    Replace /dev/sdb with whatever is correct on your system. If you're really paranoid, and are willing to wait one or two days, do this:
    dd if=/dev/urandom of=/dev/sdb
  4. Install the required packages:
    apt-get install cryptsetup
    The current cryptsetup in Debian unstable already supports LUKS, which was not the case a while ago, if I'm not mistaken. So Debian testing or stable will most probably not work!
  5. Create one or more partitions on the drive:
    cfdisk /dev/sdb
    I created one big 300 GB partition, /dev/sdb1.
  6. Setup LUKS:
    cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb1
    Enter a good passphrase here. Don't spoil the whole endeavour by chosing a stupid or short passphrase.
  7. Open the encrypted device and assign it to a virtual /dev/mapper/samsung300gb device:
    cryptsetup luksOpen /dev/sdb1 samsung300gb
  8. Create a filesystem on the encrypted device:
    mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/samsung300gb
    I used ext3 with some optimizations, see mke2fs(8).
  9. Mount the encrypted partition:
    mkdir /mnt/samsung300gb
    mount /dev/mapper/samsung300gb /mnt/samsung300gb
    That's it. Everything you write to /mnt/samsung300gb will be encrypted transparently.
  10. For unmounting use:
    umount /mnt/samsung300gb
    cryptsetup luksClose /dev/mapper/samsung300gb

After unmounting, nobody will be able to see your data without knowing the correct passphrase. Drive is stolen? No problem. Drive is broken, and you want to send it in for repair without the guys there poking in your data? No problem. You leave the USB drive at home and some jerk breaks into your house, steals your drive, rapes your wife, and kills your kids? No problem. Well, sort of, but you get the idea ;-)

There's more things you can do, thanks to LUKS: have multiple passphrases which unlock your data, change/add/remove passphrases as you see fit, etc.

Comments?

Update 2006-04-17: You have to use cryptsetup from unstable if you want LUKS support. cryptsetup in testing does not support this (thanks Ariel).

Why you should better not use Kensington Locks [Update]

This seems to be pretty old, but I only stumbled over it recently:

Just in case you were considering buying a Kensington lock to secure your laptop while you're away... don't. Some lock picker from toool.nl (Barry Wels, it seems) has demonstrated how you can open such a lock within seconds, using only a roll of toilet paper and some duct tape. Watch the pretty impressive video (7.5 MB).

Favorite quote from the video: ...so actually you're militarizingminiaturizing the roll of toilet paper.

Well, leaving a laptop unattended in a "hostile" environment is always a stupid idea (with or without a lock, with or without a screen saver with password). One of the many reasons for that is that your box can be owned by an iPod within seconds if you have a Firewire port...

(via Boing Boing)

Update 2006-03-20: I misquoted. He said "miniaturizing" and not "militarizing". Thanks Michael Goetze.

Drupal 4.5.8 / 4.6.6 / 4.7.0-beta6 fix four security issues!

New versions of Drupal are out for the 4.5.x, the 4.6.x and the 4.7.0-beta branches which fix 4 (in words: four) security issues from four different categories, namely: access control bypassing, cross-site scripting, session fixation, and mail header injection.

All the gory details are available in the release announcement and the four advisories: DRUPAL-SA-2006-001, DRUPAL-SA-2006-002, DRUPAL-SA-2006-003, and DRUPAL-SA-2006-004.

Upgrade now!

Warning: If you're using 4.5.x, the patches for DRUPAL-SA-2006-003 will not fix the security issue immediately. You have two options: a) upgrade to 4.6.6 instead of 4.5.8, or b) upgrade to PHP >= 4.3.2.

Data Mining for Terrorists

In his latest blog post Bruce Schneier explains why data mining for terrorist patterns is pretty much useless and unsuccessful, while still killing our privacy.

In the words of Schneier:

We're not trading privacy for security; we're giving up privacy and getting no security in return.

I couldn't agree more.

Syndicate content