Zdaża Ci się przeglądać dane na dysku w towarzystwie osób trzecich, które nie zawsze powinny znać jego zawartość ? Bardzo chciałeś film, który miał znajomy, ale nie skorzystałeś z przenośnego dysku, ponieważ miałeś na nim prywatne dane ? Boisz się, że prywatne dane dostaną się w niepowołane ręce ? Wolałbyś, żeby nikt nie wiedział o tym, że istnieje miejsce z poufnymi informacjami ?

Dane, ze względu na ich jawność, możemy podzielić na dwa rodzaje:

• publiczne (do nich może mieć dostęp każdy i to nam nie przeszkadza)

• prywatne (którymi dzielić się nie chcemy)

Najprostrzym rozwiązaniem byłoby kupić dwa urządzenia i przechowywać dane oddzielnie. Jest to praktyczne rozwiązanie, jednak w momencie utraty nośnika, tracimy nad nim kontrolę, co za sobą niesie ryzyko obejrzenia poufnych informacji przez osoby trzecie.

Z pomocą przychodzi nam szyfrowanie, dzięki któremu, osoba nieuprawniona do obejrzenia danych, bez podania hasła lub klucza, nie uzyska do nich dostępu.

Do realizacji tego planu wykorzystamy program Truecrypt, który dostępny jest na trzy platformy: Linux, MacOS i Windows, dzięki czemu zaszyfrowane dane ww programem. odczytamy na wymienionych systemach operacyjnych.

Szyfrowanie danych rozwiązuje takie problemy jak:

Manche Methoden IT-Systeme anzugreifen haben kuriose Namen und seltsame Hintergründe, die geeignet erscheinen, gute Geschichten zu liefern. Dazu zählt auch die Dienstmädchen-Attacke („evil maid attack“). Sie wurde erdacht, um mobile Rechner mit aktivierter Festplattenverschlüsselung stehlen und an die Daten herankommen zu können. Und um die Angreifbarkeit von Festplattenverschlüsselungstools wie Truecrypt oder Bitlocker zu prüfen.

Die Vorgehensweise:

Jemand nimmt einen Laptop mit sensiblen Informationen mit auf Geschäftsreise. Um die Informationen zu schützen, hat er eine Festplattenverschlüsselung auf dem Gerät installiert, welche die Daten durch Passwort und starke Verschlüsselung schützt. Unterwegs kommt es vor, dass er den Laptop im Hotelzimmer unbeaufsichtigt zurücklässt (ggf. per Schloss vor Entwendung geschützt).

Zu Hotelzimmern hat das Haus- und Reinigungspersonal jederzeit Zugangsmöglichkeiten. Ein Dienstmädchen, das vom eigentlichen Datendieb dazu beauftragt wurde, steckt einen präparierten bootfähigen USB-Stick an den Rechner und fährt ihn damit hoch. Auf dem Stick befindet sich ein Trojaner mit Sniffer- oder Keylogger-Funktion, der nun installiert wurde. Der Rechner wird wieder heruntergefahren und der USB-Stick wieder mitgenommen. Der ganze Vorgang dauert nur wenige Minuten und erfordert seitens des Durchführenden keinerlei tiefere technische Kenntnisse.

Später als der Geschäftsreisende wieder mit dem Laptop arbeitet, gibt er u.a. das Passwort zur Entschlüsselung der geschützten Daten ein, meldet sich am Firmenintranet an und tätigt andere mit Login geschützte Arbeiten. Der im Hintergrund mitlaufende Schnüffeltrojaner zeichnet alles auf.

Einige Tage später wird der Laptop tatsächlich gestohlen. Und da der Dieb sich durch den zuvor installierten Keylogger die Passwörter für den Zugriff auf die verschlüsselten Daten beschafft hat, kann er nun alle auf dem Rechner vorhandenen Informationen entwenden.

Eine linuxbasierte Referenzimplementation für die Evil Maid-Attacke per USB-Stick kann man vom The Invisible Things Lab’s blog herunterladen. Was für Zwecke des Selbststudiums und des Experimentierens mit eigenen Geräten noch legal ist, dürfte spätestens beim Einsatz „in the wild“ die Kriterien des sog. „Hackerparagraphen“ erfüllen.

Wie kann man sich nun vor dem „bösen Dienstmädchen“ schützen?
Joanna Rutkowska, CEO bei Invisible Things Lab und Erfinderin dieses Angriffs sowie Graham Cluley von Sophos schlagen dazu in ihren Blogs Folgendes vor:

Um zu vermeiden, dass in Abwesenheit des Besitzers andere unbemerkt mit dem Laptop arbeiten, sollte der Rechner nicht nur softwareseitig sondern auch physisch geschützt sein. Beispielsweise indem er in einem Hoteltresor verwahrt wird.

Besteht allerdings auch nur die Wahrscheinlichkeit, dass zwischenzeitlich jemand unberechtigten Zugriff auf den Rechner hatte, so hätte seine weitere Nutzung an sich zu unterbleiben, bis er einer sorgfältigen technischen Überprüfung (auf Veränderung der Hardware) und einer anschließenden Neuinstallation des Systems sowie der Software unterzogen wurde. Ein Aufwand der in der Praxis vieler Geschäftsleute auf Reisen wohl nicht betrieben werden dürfte.

Denkbar wäre auch der Einsatz von Laptops, die weder über USB-Anschlüsse noch bootfähige Medien (z.B. DVD-Laufwerke) verfügen, was aber in der Praxis oftmals schwer durchzusetzen sein dürfte.

Viele Attacken der „Evil Maid“-Machart können durch Trusted Computing Architekturen und einem entsprechend geschützten Bootprozess durch ein sicheres Betriebssystem verhindert oder zumindest technisch deutlich aufwändiger gestaltet werden, so dass die meisten  in Frage kommenden Angreifer ausscheiden.

Auch der Einsatz einer Zweifaktoren-Authentifizierung (z.B. Passwort + biometrisches Merkmal oder Token) beim Zugriff auf die verschlüsselten Daten kann von Keyloggern nicht so ohne Weiteres überwunden werden, da sie nur das Passwort, nicht aber das biometrische Merkmal oder den Token abgreifen können.

Zudem sollte das Booten von USB-Sticks im BIOS des Rechners deaktiviert werden. Allerdings macht das eine Dienstmädchen-Attacke nicht unmöglich sondern nur aufwendiger. Das Dienstmädchen (oder ihr Auftraggeber) hätten nun die Festplatte des Laptops auszubauen und in einen mitgebrachten Netbook einzustecken, um von dort per USB-Boot den Trojaner aufzuspielen. Und sie anschließend wieder in den ursprünglichen Rechner einzubauen. Ein darin geübter Angreifer schafft das in etwa 10-15 Minuten. Auch das BIOS selbst sollte passwortgeschützt sein, so dass ein Angreifer vor Ort die USB-Deaktivierung nicht rückgängig machen kann.

A new version of the popular free disk encryption tool is available for download: http://www.truecrypt.org/downloads

“Minor improvements and bug fixes.  (Windows, Mac OS X, and Linux)”

Hallo und nein,

der Titel soll jetzt keine ironisch-schlechte Anspielung auf das kostenpflichtige Service Pack 3 für Vista sein, sondern tatsächlich meinen momentanen Gefühlszustand beschreiben. Bezüglich meiner aktuellen Internetanbindung versteht sich… also keine Angst, ich bin immer noch der alte!
Nach guten zwei Jahren und diversen Kommunikationswegen (von Rauchzeichen, über Brieftauben bis hin zum Mobile Internet via UMTS 3.5G), bin ich nun endlich stolzer Besitzer einer richtig echten Breitbandverbindung. Yeah!
Gut Ding will halt Weile haben…

Alleine aufgrund der Tatsache, dass meine jetztige Upload- meiner früheren (an guten Tagen) Download-Geschwindigkeit entspricht und das Ganze sogar nur noch halb so viel pro Monat kostet, bin ich mit dem Speedtest schon mehr als nur zufrieden.

Auch wenn das natürlich in keinster Weise im Zusammenhang steht, habe ich mir auch gleich eine neue externe USB-Festplatte (“My Book” von Western Digital – 1TByte) zugelegt, die ich gestern unter Ubuntu nach “nur” 9-stündiger Formatierung mit TrueCrypt in Betrieb nehmen konnte. Solange ich noch nicht auf Chrome OS umgestiegen bin und meine sensiblen, sprich persönlichen Daten einfach in ner cloud vor fremden Zugriffen sicher schützen kann, ist diese Wartezeit meiner Meinung nach gut investiert!

Es bleibt also nur noch zu hoffen, dass meine jetztige “Euphorie” eine gute Kondition hat, also die Zuverlässigkeit der “My Book” nur annähernd ihrem Design entspricht und ich mich in kurzer Zeit nicht wieder kleine Papierröllchen an Taubenfüße binden sehe.

Drückt mir die Daumen…

]]> http://simonhunt.wordpress.com/2009/11/17/evil-maid-another-nefarious-trojan-attack/ Tue, 17 Nov 2009 16:50:29 +0000 Simon Hunt http://simonhunt.wordpress.com/2009/11/17/evil-maid-another-nefarious-trojan-attack/ http://rafaelbs.wordpress.com/2009/11/16/pendrive-seguro/ Mon, 16 Nov 2009 20:15:58 +0000 rafaelbs http://rafaelbs.wordpress.com/2009/11/16/pendrive-seguro/

Você tem um pendrive? Eu tenho dois, um de 2Gb e outro de 16Gb. Uso muito o pendrive para carregar diversos tipos de arquivos como documentos da empresa, fotos, download de algum software que uso muito, mp3, etc. Coisas que não me trazem prejuízo se forem perdidas, fora o próprio pendrive. Poderia recuperar tudo facilmente…

Mas e o prejuízo que terei caso alguém com má intenção encontre meu pendrive perdido? Que fim terão as fotos da pasta “final-de-semana-na-praia”? Ou aquele documento com estratégias da empresa, proposta comercial, dados de clientes, etc? E a cópia do meu imposto de renda? O código fonte de um software que estou desenvolvendo? Já calculou? Não dá pra mensurar este prejuízo.

Existem algumas soluções para amenizar estas consequências, e eu vou falar sobre duas.

A primeira é um pendrive com leitor biométrico, que fica sempre bloqueado e só é liberado

Pendrive com Leitor Biométrico

quando o dono passa a o dedo no leitor. Ponto positivo: fácil de usar, qualquer um com o mínimo de noção em informática pode adquirir um desses e começar a usar. Ponto negativo: Será que existe uma solução caso o leitor biométrico pare de funcionar? O modelo ao lado é o JetFlash230 da Transcend, que custa R$ 94,00 na Americanas.com.

A outra solução é utilizar um software de criptografia muito eficiente, grátis e open source, o TrueCrypt.  Com ele você pode escolher se quer criptografar o pendrive inteiro ou apenas uma parte dele. Também é possível configurá-lo para que quando o pendrive for conectado ao computador, automáticamente uma senha seja solicita, que após digitada corretamente desbloqueia a parte criptografada e monta o volume. Ponto positivo: mais recursos e proteção mais avançada (diversos tipos de criptografia). Ponto negativo: para quem não tem uma certa intimidade com informática, vai quebrar um pouco a cabeça para fazer funcionar.

Fica aqui minha dica: não deixe para pensar nisso depois que você perder o seu pendrive!

The password debate never ends.  Instead, it seems to be increasing in intensity.  The problem is the use of passwords isn’t going away anytime soon.  The cost of replacing passwords with a more secure access control method is typically too high, making it impossible to sell related projects to management.  Even the use of strong passwords is often regarded as either less secure—because users inevitably write them down—or a hindrance to productivity.  However, there may be a middle ground which can help bridge the timeline between password use and multi-factor authentication.

Background

Before jumping into the how-to part of this article, I want to look at how security professionals view password risk and related management.  A recent post in the SANS Internet Storm Center Diary, along with reader posts, sums this up pretty well.

There are four basic ways for a bad guy to get your password:
(a) Ask for it. So-called “Phishing” and “Social Engineering” attacks still work, and always will
(b) Try dictionary words at the login prompt in the hope to get lucky (“Brute Force”)
(c) Obtain the encryped/hashed [sic] password somehow, and crack it
(d) Leech the password off your computer with keylogger malware

None of these four scenarios becomes less likely if you change your password every 90 days. If the bad guy can’t break the password hash (c) within a couple days, he’ll likely just look for an easier target. Attack (b) is also out for quick wins – either it works within the first couple dozen passwords tried, or the bad guy moves on to easier prey. If (b) or (c) are successful, or the attacker already has the password through (a) or (d), 45 days on average is more than enough to empty out your bank account or use your email address for a big spam run.

Source:  Password rules: Change them every 25 years, Daniel Wesemann, 2 November 2009

For me, the two takeaways from this article are:

• There is more than one way to compromise and use a password access control, all of them tested and in wide-spread use
• The common account policy of requiring a password change every 45, 60 or 90 days is not a good security control

No, this doesn’t mean you should throw up your hands, assign the same simple password to all your accounts, and hope for the best.  If you can use a second authentication factor, if your organization or you can afford it for work or personal use, then implement it.  If not, I may have an alternate safeguard.

Two Factor Passphrases

First, this is not an original idea of mine.  I heard Steve Gibson discuss the concept on a Security Now podcast.  However, I’m taking it a bit further by extrapolating the concept into a complete solution.

I am not a proponent of strong passwords.  Users write them down or forget them, causing either security audit or productivity issues.  I also agree with Wesemann and his readers that changing a password frequently isn’t a good way of protecting  personal or organizational assets.  So I combined the use of random passwords with a memorable passphrase to develop a process I believe solves most—not all—problems with passwords.

1. Obtain a 13 character random password.  I used Steve Gibson’s random password generator for my example, and selected GSD6BtvzM4A0j.
2. Write down a phrase with 7 or more words.  I used, “Every Day I Look Better and Better.”  (I hope my wife doesn’t read this…)
3. Use the first character of each word in the phrase to arrive at an initial series of characters.  In my example, this works out to EDILBAB.
4. Change one or more of these characters to make the string a little harder to guess.  3D1LB+B.
5. Enter the 13 character random password into a text file and memorize the 7 character string from Step 4.

We now have two factors for authentication—something we have (GSD6BtvzM4A0j) and something we know (3D1LB+B).  Combining these two character strings into a number of different passwords is easy.

1. Go to one of your password protected sites.  I used my bank.
2. Change your password to a new two factor passphrase:
   1. Copy the 13 character string from your text file and paste it into the new password field.
   2. Insert your memorized 7 characters into the 13 character string.  I decided to insert it in the second character position, coming up with G3D1LB+BSD6BtvzM4A0j as my 20 character, sort-of random, password for this site.
3. Record the site and the character position in your password text file.  I list three password insertion points in Figure 1.

Figure 1

Note the Bank location is 3, not 1.  I inserted another layer in the process by adding 2 to actual insertion points.  This probably isn’t necessary, but I’m more paranoid that most.

Each time I step through the new/change password process, I try to select a different insertion location.  Yes, I will quickly run out of insertion points.  However, I will still have 14 strong passwords instead of one. 

If every time I log in I copy and paste the 13 character string into the password field, most of the password is unreadable by typical keyloggers.  The only portion of the password a keylogger would see is the 7 memorized characters as I enter them.  Brute force attacks against those sites or networks without a maximum number of incorrect attempts set are very difficult when using passwords of this size.  In fact, the work factor required to crack my sample password should be high enough to deter anyone from getting to any data my computer or sites might have to offer.  This also solves the problem of strong passwords, since we are actually recording the hard-to-remember part of the password. 

The final step is safely storing the text file with your password fragment and insertion points.  The easiest way I found of both protecting the file and having access to login information wherever I go is to use a TrueCrypt protected USB memory stick.  I use a long passphrase which I never use for anything but accessing mobile TrueCrypt data stores.  An attacker would have to gain physical access to the device to crack the password.  There would be plenty of time between the time I lose my USB device and the cracking of the encryption (if ever) to allow me to change my passwords.

The Final Word

No, this isn’t for everyone.  The complexity of this process would bring a normal user to tears.  However, this approach or your version of it can help protect,

• Network administrator accounts
• Accounts used to access highly sensitive information
• Your own accounts

A new version of the popular free disk encryption tool is available for download: http://www.truecrypt.org/downloads

Included in the new release is full support for Windows 7  and Mac OS X 10.6 Snow Leopard. Click here to see for more info on the new release (http://www.truecrypt.org/docs/?s=version-history).

Wer mich kennt, der weiß wie paranoid ich meine Daten schütze. TrueCrypt (für Festplatten-, Partitions- und Containerverschlüsslungen) und AxCrypt (für einzelne Dateien) sind immer installiert, meine Passwörter sind entweder sehr lang, oder teilweise auch ganze Sätze. Passwörter welche ich nicht auswendig wissen muss, werden mit KeePass automatisch generiert und dort auch gesichert. Wo es geht (KeePass & TrueCrypt), werden zusätzlich zum Passwort noch keyfiles verwendet. Und wenn ich Angst vor Keyloggern habe, dann werden die Passwörter auch schon mal per On-Screen Keybord eingegeben (gerne kombiniere ich auch Tastatur und On-Screen Keybord).

Bis jetzt wurde ich deswegen immer nur müde belächelt, aber vielleicht ändert sich das ja mit diesem Artikel der iX. So kostet das “Knacken” (per Try’n’Error) eines Passworts mit 9 Zeichen aus Ziffern und Buchstaben gerademal 2.000 US-Dollar. Und 9 Zeichen sind echt nicht viel – die meisten Bekannten, Verwandten und Freunde verwenden häufig weniger Zeichen und oft auch nur Buchstaben oder nur Zahlen.

Ich kann nur jedem raten: beschäftigt euch ein wenig mit den o.g. Programmen! Sie bieten viel zusätzliche Sicherheit – ohne das man zu sehr an Produktivität einbüßen muss.

Tidak sengaja melihat nama Peter Kleissner waktu melirik ke majalah CHIP yang sedang dibaca oleh Richard (temen kantor). Ada fotonya disitu, lumayan cakep, yah biasalah, liat foto cakep sedikit, langsung googling.. . Setelah googling, ternyata memang Peter orang yang menarik, kisah hidupnya menegangkan untuk diikuti (huehehehe kyk nonton film) dan yang bikin menarik lagi, adalah dia baru berusia 18 tahun. Aku tidak akan nge-judge dia ‘baik’ atau ‘buruk’, aku hanya ingin menulis tentang dia, karena… karena apa ya? Hmm… karena dia memang menraik perhatianku..

Peter Kleissner

Sekitar tanggal 20 Oktober aku melihat nama Peter Kleissner dan aku langsung googling, siapa sih sebenernya orang ini? Peter adalah seorang hacker muda, namanya dikenal oleh dunia sejak agustus 2009 saat ia diundang sebagai pembicara pada BlackHat event: Hacking at Random 2009 di Las Vegas, USA. Peter sendiri mengaku sebagai Independent Operating System Developer dan Professional Software Engineer and Malware Analyst.

Dia tinggal di Vienna Austria, tidak begitu tahu backgroundnya seperti apa, tetapi dari websitenya web17.webpro.de, pada tahun 2003 dia sudah mulai membuat aplikasi. Karena sekarang umurnya 18 tahun, artinya tahun 2003 dia baru 12 tahun (wew..), tahun 2005, Peter mulai membangun OS nya sendiri yang diberi nama ToasterOS dan selesai pada tahun 2007. Selama membangun ToasterOS, Peter menulis dua buah buku dan lebih dari 50 paper mengenai OS development. Pada 2008 (17 tahun) dia bekerja pada sebuah perusahaan software security, Ikarus. Selama bekerja pada Ikarus Peter menganalisis beberapa virus, antara lain conficker dan sinowal, selain itu, Peter juga menulis sebuah virus yaitu Stoned Bootkit.

Peter Kleissner

Stoned Bootkit adalah virus yang menyerang sistem operasi Windows, mulai dari Windows 2000 sampai dengan Windows 7RC. Stoned sendiri sebenarnya adalah virus jaman baholak… virus stoned pertama kali muncul pada tahun 1987, kemudian Peter menulis versinya yang lebih canggih. Virus ini menyerang Master Boot Record dengan cara mengoverwritenya.. , bisa di download di www.stoned-vienna.com… kalau mau.. hehehe…Stoned Bootkit inilah yang kemudian membawa Peter menjadi pembicara pada acara BlackHat: Hacking at Random 2009. setelah menjadi pembicara di BlackHat, Peter diminta keluar dari Ikarus karena banyak komplain. Yah… hmmm.. gimana ya.. dia kerja di perusahaan anti virus, tapi malah bikin virus… banyak yang pro maupun kontra dengan kejadian ini. Stoned Bootkit juga pernah rame dengan TrueCrypt, baca di Peter Kleissner VS TrueCrypt.

Peter kemudian membangun AVTracker, sebuah web service dimana bisa digunakan untuk menghalangi antivirus yang melakukan checking pada website-website yang bervirus. Service ini bisa digunakan oleh para penulis virus agar “karya”nya tidak terdeteksi.. hehehe…

 AVTracker inilah yang kemudian membawanya menuju masalah. Sejak diluncurkan ke internet, ada beberapa yang mencoba untuk melakukan usaha injection pada www.avtracker.info antara lain lab kampusnya sendiri (TU Wien : Technical University of Vienna) dan Kaspersky lab.

Karena di hack oleh Kaspersky, avtracker.info sempat tidak beroperasional (menurut email Peter kepada pihak Kaspersky) dan Peter meminta ganti rugi sebesar 2000 Euro, dan bila dalam 1 X 24 jam emailnya tidak dibalas, maka Peter akan mempublish log webnya saat Kaspersky berusaha memasukkan malware ke websitenya, serta akan menuntut pihak Kaspersky melalui hukum.

Pihak Kaspersky kemudian membalas emailnya, pakai bahasa jerman, aku gak ngerti artinya, tapi setelah di translate ke bahasa inggris kira-kira artinya : “Yang anda lakukan adalah kriminal, mari diselesaikan secara hukum“ (kayaknya…), baca sendiri aja deh di www.peterkleissner.com.

Peter Kleissner

Kaspersky lab melakukan hack pada AVtracker pada tanggal 20 Oktober 2009. Karena tuntutannya tidak dipenuhi, pada tanggal 22 Oktober 2009, Peter mempublish aktivitas kaspersky pada avtracker.info melalui websitenya. Tanggal 23 Oktober 2009, Peter dikeluarkan dari kampusnya (menurut twitter nya), karena flash disk dosennya kayaknya (gak tahu juga.. hehehehe).

Vitaly Kamluk, director of research di giant Kaspersky Lab di Rusia menulis sebuah posting di www.viruslist.com, bahwa Peter juga mengirimkan malware pada Kaspersky dan beberapa anti virus lain untuk melacak alamat-alamat internet dari scanning machine anti virus-anti virus, dan pada malware itu terdapat sebuah pesan, yang berisi nama penulisnya dan kataerkaitannya pada gang penulis malware. Pihak Kaspersky telah menyerahkan kasus ini pada para pengacaranya agar diusut.

 Washington Post menulis mengenai kejadian ini di voices.washingtonpost.com, dan mewawancarai Peter. Peter mengatakan bahwa dia kecewa telah diasingkan oleh komunitas anti virus, dan dia juga mengakui bahwa malware kirimannya juga agak kelewatan.

“I’m always doing computer research stuff, and people can use my knowledge or not, but I won’t stop publishing things,” katanya.

Peter juga menyangkal bahwa dirinya yang dulu bekerja pada anti virus sekarang manjadi jahat.

“I have done lots and lots of research and helped other anti-virus vendors, and I’m always open for anything,” he said. “I won’t make a difference between black hats and AV companies. To me it’s not good or bad, it’s just technology.”

Hmm :) Selesai. Itulah Peter Kleissner. Kalau ada yang salah kasih tau ya….

The best way of protecting your data (the red dot).

This week, we’re going to be looking at staying secure and safe when using a computer. Today, we look at how you can protect your PC and its files.

Yesterday, we looked at some basic ideas with regard to protecting your WoW / Battle.net account. Now, rather than bore you all again with dry and generic tips – use a strong password! – I’m instead going to lighten things up a bit and suggest some free and useful pieces of software which might interest you.

TrueCrypt

Just the other day I was taking a look at the family computer, finding ways to speed it up because it apparently had very slow performance issues. Would you believe the Recycle Bin hadn’t been emptied in ten months and there were approximately 49000 temporary internet files? Anyway, I digress. While checking it out, I noticed a piece of paper lying next to the monitor. A piece of paper on which every single password for the computer was written down with accompanying user names and web addresses, left for the world to see! You have to ask yourself, what’s the point of passwords if you’re going to leave them lying around like that?

Now, I can appreciate that some people can’t remember twenty different passwords and user names, but you should never really write them down. If you absolutely have to, it’s only clever if they’re then very secure and hard to get at. There are three ways to accomplish this:

1. An online “password manager”
2. An encrypted file on your computer
3. A piece of paper locked inside a safe which requires both a combination and a key, hidden behind a painting, surrounded by CCTV cameras and heat-sensing, infrared laser beams, found inside a sealed vault, protected by armed guards, inside a fortified building. See the above diagram for visual reference.

Now, obviously you’ll probably have the most luck with the third option, but we don’t all have the ability to organise something like that. Nor do I advise the first option; as popular as they may be, I wouldn’t entrust anything private to something online – my theory goes that if something is online, it’s available for the whole world to try and get at. If it’s localised to a computer, you generally need the computer itself to try and get at it, which reduces the threat significantly. Hence, encryption is the answer.

Now, there are many different types of encryption and many different programs which will encrypt and decrypt data for you. My preferred choice is a program called TrueCrypt which uses AES (Advanced Encryption Standard) – one of the best accepted methods of encrypting data. Simply put, the software can create an encrypted file within which you can put other files or information, just like a normal folder. To open the file, you have to enter your password, and this is where you need something very strong:

• At least 20 characters
• Numbers and letters
• Special characters
• Upper and lower case
• Non-recognisable words

Getting back to the idea of keeping your passwords safe, what you can do is create a small TrueCrypt file, and just put a plain text file inside it (using Notepad or similar) which contains your list of passwords. That way, they’re mostly protected from the internet by being on your computer, but you can’t open the list without the master password, protecting them from local attacks. TrueCrypt also has the option of creating a hidden folder – one which can’t actually be located unless you know where to look – if you’re up for something more advanced.

There is just one weakness here. What if you accidentally leave the list decrypted and open on the computer (fool), and you’re using a laptop? Somebody could steal it and make off with the list! Or could they?

LAlarm

LAlarm is basically a car alarm – but for a laptop. It can be configured to sound an alarm upon several different events – for example, when the power lead is removed or when a USB device is unplugged. The latter could be particularly useful if you need to leave it in public; plug a USB drive in which has a lead connected, and tie the lead around a table or something equally unmovable. To take the laptop, the potential thief has to remove the USB, at which point, BEEP BEEP BEEP BEEP BEEP!

The software can also do fancy things like destroying specified data (perhaps your passwords?) when it’s stolen, and it can be set up to send you a text message if it is. There are other features too – check it out for yourself on its website.

Tomorrow, we’re going to look at internet security to finish off this short series of guides.

Vel.

Will man (z.B. auf dem eee-pc) die Bootpartition mittels Truecrypt verschlüsseln, gibt es ein Problem: Truecrypt zwingt den Benutzer, eine Rescue-DVD zu erstellen und zu brennen. Da der eee-pc aber keinen Brenner hat, geht das schlecht.

Abhilfe schafft der Parameter /n, den man Truecrypt beim Starten übergeben kann:

TrueCrypt 6.3 wurde veröffentlicht. Die neue Version unterstützt nun offiziell Windows 7 und Mac OS X 10.6 Snow Leopard. Desweiteren wurde die Möglichkeit Volumes als “System Favorites” zu definieren, hinzugefügt.

Weitere Infos und den Download findet Ihr hier:
Verschlüsselungssoftware TrueCrypt 6.3 erschienen

Dropbox is a service for backup and synchronization of files, and it runs on Windows, Mac OS X and Linux.  As I pointed out before, I’d like to be able to use Dropbox without security torments. I don’t think that the guys who run Dropbox really want to peek inside my files, but the risk that someone else does indeed gain access to my data, accidentally or intentionally, is not negligible. A malicious employee, a security breach, the company is sold… I want to feel safe; I need a solution that, on top of Dropbox, adds the security I need. One of the best things about Dropbox is the ability to run on most computer platforms, so a nice solution to the security problem should also possess this quality. The most portable solution up to now seems to be the addition of TrueCrypt. TrueCrypt is a cross-platform encryption software that, among other functionalities, creates files that can be used as encrypted volumes. The idea is to put these encrypted files (that can be considered as safety vaults) inside Dropbox, and to use TrueCrypt on the local copy of the files to decrypt and access the private data. In this way, the data that is stored inside Dropbox is completely unusable by everyone, except the ones who can decrypt it. The decryption can involve a password that a user must remember, a key file that a user must have in his computer, or both.  I like the idea of having both because then, in order to read my data, a potential spy must have:

• The encrypted vault file (located in my Dropbox or any other computer linked to it)
• The key file (located in my computers or inside a USB drive)
• The password (located in my brain)

I think the only feasible attacks to read my data would then be aimed at reading it when I have decrypted it (other than beat me with a 5$ wrench to make me hand over my USB drive and spit out the password).

Installation steps in brief:

• Install Dropbox
• Install TrueCrypt (or use it in Portable Mode)
• Create a TrueCrypt encrypted vault file (with optional key file)
• Put the vault file in a Dropbox folder
• The vault file is automatically synchronized by Dropbox

For each other computer that you want to use to access the vault, you need to:

• Install Dropbox
• Install TrueCrypt (or use it in Portable Mode)
• Synchronize the Dropbox folder (to download the vault file)
• Copy the optional key file

The common use case to access your private data will then be:

• Mount the vault
• Access or modify the files inside the vault
• Unmount the vault
• The vault file is automatically synchronized by Dropbox

Tips to Ubuntu users:

I created a simple script that opens/closes a vault. It can be easily added to the “Applications” menu.

#!/bin/bash

MOUNT_DIR="${HOME}/truecrypt"
VAULT_FILE="${HOME}/Dropbox/Vault.tc"
KEY_FILE="${HOME}/Vault.tck"

if mount | grep "${MOUNT_DIR}" >/dev/null; then
    truecrypt -d "${VAULT_FILE}" && zenity --info --text="Vault closed: ${VAULT_FILE}";
else
    test -d "${MOUNT_DIR}" || mkdir -p "${MOUNT_DIR}"
    truecrypt --keyfiles="$KEY_FILE" "${VAULT_FILE}" "${MOUNT_DIR}" && gnome-open "${MOUNT_DIR}";
fi

Another useful trick for Linux/Mac users is to keep the files in the Dropbox folder, and create a link where you need them using “ln -s target link_name“. For example, you can copy the “places.sqlite” file that is inside your Firefox profile, and contains your bookmarks and history, inside the Dropbox folder, and create a link to it in your Firefox profile folder. Doing so, you can synchronize your Firefox bookmarks for all your computers.

Sehr schöne Verschwörungstheorie: http://blog.fefe.de/?ts=b4365619

Text folgt

Fotografias pessoais, dados bancários e ficheiros de trabalhos, projectos e relatórios, passeiam-se todos os dias nas malas de estudantes e profissionais, comodamente guardados nas suas pen discs ou discos portáteis, mas o risco de que a perda destes dispositivos ou olhares indiscretos revelem os segredos que albergam é elevado.

À mobilidade crescente dos dados, que os coloca em situações de maior susceptibilidade às perdas e roubos, juntam-se os ataques a PCs ligados à Internet ou a redes empresarias, assim como a simples coscuvilhice de colegas e outras pessoas com acesso físico aos equipamentos.

Os cenários que envolvem os roubos de dados são bem conhecidos de todos, sobretudo pelo aparecimento de inconfidências nos jornais ou por notícias que dão conta de “perda” de portáteis com informação confidencial de grandes empresas.

Programas para protecção de dados da sua pendrive!

O TrueCrypt é uma das aplicações mais conhecidas e descarregadas, estando disponível para download gratuito. A aplicação permite criar um disco virtual no seu computador ou na pen que não passa de um ficheiro cifrado, acessível apenas por password.

Esta aplicação é uma das mais completas no suporte a algoritmos de cifra, abarcando o AES-256, Blowfish, CAST5, Serpent, Triple DES e Twofish.

O TrueCrypt suporta também várias versões do Windows e pode ser usado com sistemas operativos Linux e MacOS X.

O FreeOTFE é outra alternativa viável para sistemas Linux e Windows, que funciona igualmente com a criação de drives virtuais. Para além de um modo “portátil, que dispensa a instalação antes da sua utilização, o FreeOTFE tem um modelo de Explorer que permite aceder a volume cifrados sem instalar o software.

A aplicação tem versões em Alemão, Italiano, Francês e Inglês, e, tal como o TrueCrypt, é um projecto open source cujo código pode ser descarregado no site.

O modelo open source está também na base do CrossCrypt que pode ser usado em Windows mas também em Linux e pode ser especialmente útil para quem tem computadores dual-boot.

Para completar o conjunto de quatro aplicações, citamos ainda o CompuSec que não perde em popularidade com o TrueCrypt e que suporta também várias versões de sistema operativos Windows de 32 bits e Linux, garantindo ainda apoio técnico grátis online.

Há ainda uma série de aplicações comerciais que podem ajudar a proteger os seus dados, mas estas estão mais à mão para que possa experimentar.

Claro que só fazer o download não é suficiente e, para que a protecção exista de facto, é preciso começar a cifrar a informação mais sensível. De preferência já hoje!

Da cosa parto

Come molta gente che usa un sistema Linux sull’hard disk ho una partizione con su installato Windows, che uso esclusivamente per farci girare software che ha bisogno di questo sistema operativo. Windows Vista è sulla prima partizione dell’hard disk (sda1), Kubuntu sulla seconda (sda2). Una terza partizione contiene la home di Linux (/home su sda3). Svariate altre partizioni contengono solo dati. Sul MBR c’è GRUB che gestisce il dual-boot. Tutto l’hard disk è chiaramente in chiaro.

Dove voglio arrivare

La soluzione ideale sarebbe quella di criptare tutto l’hard disk e mantenere i sistemi operativi funzionanti come ora, magari con la praticità di un’unica password richiesta all’avvio del pc. In giro per la rete non ho trovano niente di simile (e in ogni caso non sarebbe una soluzione efficiente perché prevede l’uso di una sola chiave di criptografia).
Un approccio sensato sarebbe quello di andare oltre la criptazione delle sole partizioni contenenti dati.
Questo discorso è maggiormente valido sotto Windows, dove tra cestino, file temporanei, file di swap, file di ibernazione e altro c’è l’effettivo rischio di copiare in chiaro su una partizione non criptata dei file provenienti da partizioni criptate. È opportuno allora criptare la partizione di Windows e quella di programmi di terze parti (se diversa) oltre alle partizioni dei dati.
Con Linux il ragionamento è analogo, ma ci si potrebbe limitare alla criptazione della directory /home (che quindi dovrebbe essere montata su una partizione separata) visto che durante l’uso di una sessione normale (non da utente root) la scrittura dovrebbe essere limitata a quella directory.
L’intenzione in ogni caso è quella di criptare la maggior parte del disco fisso, con un buon compromesso tra praticità di utilizzo e prestazioni. Le chiavi e gli algoritmi di criptazione dovrebbero essere il più possibile diversi tra le varie partizioni/sistemi operativi. In più sarebbe buona cosa poter accedere a tutti i dati presenti su tutte le partizioni, indipendentemente dal sistema operativo in uso.

TrueCrypt

Da tempo uso TrueCrypt per creare i cosiddetti contenitori, file che si comportano come dischi virtuali che vanno montati (e decriptati) per poter accedere al loro contenuto. TrueCrypt ha il vantaggio di essere  multipiattaforma, e questo mi ha sempre permesso di accedere ai miei dati sia da Linux che da Windows.
Ho cercato di capire cosa poteva offrirmi questo software che già conoscevo. La versione per Windows ha uno strumento in più: si chiama system encryption e permette di cripare la partizione del sistema operativo con due vantaggi rispetto alla pratica che si applica ai contenitori:

• la fase di criptazione avviene sfruttando l’installazione di Windows già esistente (e in chiaro), quindi non è necessario svuotare la partizione, criptarla e poi riempirla. Non serve reinstallare il sistema operativo. In aggiunta questa fase viene eseguita durante il funzionamento regolare di Windows, che può essere usato nel frattempo (quasi) come niente fosse.
• Il processo precedente è reversibile, cioè si può procedere alla decriptazione della partizione in qualsiasi momento. Tale possibilità mi avrebbe protetto da eventuali ripensamenti o errori.

Questa criptazione di sistema implica l’installazione di un boot-manager ad hoc (non supporta il dual-boot) che all’avvio richede la password all’utente. Questo ovviamente sovrascrive il MBR. In ogni caso se invece di inserire la password si preme Esc il boot-loader di TrueCrypt rimanda alla prima partizione avviabile che trova.

Come mi sono mosso

Prima di eseguire la criptazione di Windows ho eseguito una piccola utility che si chiama HDHacker, ottenibile da questa pagina. Questo software molto intuitivo permette di copiare e scrivere il MBR. Ho fatto una copia del MBR attuale in modo da poterlo ripristinare in caso ne avessi bisogno.

Ho avviato la criptazione di sistema su Windows con TrueCrypt come detto sopra: al riavvio il MBR è stato sovrascritto e dopo l’inserimento della password nel boot-manager si è avviato Windows criptato. Ad un successivo riavvio ho premuto Esc alla richiesta della password, ma Linux non si è avviato perche la sua partizione (sda2) non è avviabile.

Ho dovuto quindi rendere la partizione di Linux avviabile. Per far questo ho bisogno di avviare Linux e usare alcuni comandi di GRUB. Ho riavviato il computer con un LiveCD di Kubuntu e da terminale ho usato:

$ sudo grub

per avviare GRUB, e poi nella shell di GRUB:

> root (hd0,1)
> setup (hd0,1)
> quit

Ricordo che con hd0,1 GRUB intende la seconda partizione sul primo hard-disk (la numerazione parte da 0): in pratica mi riferisco a sda2. Il primo comando serve ad indicare dove è installato GRUB (cioè la partizione dove è presente la directory /boot), il secondo scrive sul boot-sector della partizione in modo da renderla avviabile. Il terzo comando chiude la shell di GRUB e torna al terminale. Ho riavviato.

Finito.

Adesso all’accensione del pc si avvia il boot-loader di TrueCrypt: inserendo la password ho accesso a Windows e alla sua partizione criptata, premendo Esc si avvia GRUB. Chiaramente ciò che appare nell’elenco delle possibili scelte dipende dal file menu.lst, quindi, sebbene sia presente anche la voce relativa a Windows tra i sistemi avviabili, (da GRUB) posso solo lanciare Linux.
La partizione criptata di Windows è esplorabile anche da Linux montandola con TrueCrypt.

Sviluppi futuri

Adesso bisognerà criptare la home di Linux ed eventualmente anche la partizione di swap (ma a questo dedicherò un altro post).
Va notato che lo stato attuale è perfettamente reversibile allo stato pre-criptazione (se occorresse): basta decriptare Windows come detto sopra e rimettere il MBR originale di GRUB (copiato con HDHacker a inizio procedura) al suo posto.

Penso di poter invece risolvere subito questo problemino: attualmente dopo aver skippato il boot-manager di TrueCrypt se ci ripenso e decido di voler avviare Windows devo premere la combinazione Ctrl+Alt+Canc e ripartire da capo. Vorrei poter impostare di avviare il boot-manager di TrueCrypt da GRUB.

Ulteriori risorse

Potrebbe essere utile fare una copia di backup del MBR su file. Il comando è questo:

dd if=/dev/sda bs=512 count=1 > MBRbackup

Mentre per ripristinare il MBR da una copia di backup:

dd if=MBRbackup of=/dev/sda bs=512 count=1

Aggiornamento del 10/10/09

Ho appena scoperto che la criptazione di Windows (o dell’intero disco) effettuata con un system encryption di TrueCrypt (che prevede quindi il boot-loader) è raggirabile attraverso un bootkit chiamato Stoned Bootkit. A dimostrazione del fatto che chi è varamente deciso ad ottenere quel che vuole con gli strumenti adatti può riuscirci, la pagina linkata precedentemente dice: 

It is even able to bypass full volume encryption, because the master boot record (where Stoned is stored) is not encrypted. The master boot record contains the decryption software which asks for a password and decrypts the drive. This is the weak point, the master boot record, which will be used to pwn your whole system. No one’s secure!

L’infezione avviene a Windows avviato e per l’esecuzione sono richiesti i diritti di amministratore. Una volta infetti non c’è antivirus che tenga perchè il bootkit è caricato a livello di kernel.