Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Roy M. Silvernail (royrant-central.com)
Date: Thu Feb 21 2008 - 15:49:08 CST
On Thu, Feb 21, 2008 at 04:34:09PM -0500, Rory Wasserman wrote:
> I agree with what you are saying, however if a portable hardware device is
> used for multifactor authentication and the key is stored in a secure place
> on the device, off of the hard drive, then this type of attack would be
I think you still misunderstand the threat model. The threat is not
against authentication. That has already been done and the
target machine is in a running state (though perhaps waiting at a
screensaver password). In this state, the fully-encrypted disc is
mounted and decrypting for its proper user. That means the FDE key
*must* be in core somewhere, so that the disc drivers can use it to
encrypt and decrypt the data as it is used.
And once Mallory has the FDE key, he don' need no steenkin'
authentication. He grabs an image of the disc and trots off to decrypt
Roy M. Silvernail is royrant-central.com, and you're not
"A desperate disease requires a dangerous remedy."
- Guy Fawkes
Dataloss Mailing List (datalossattrition.org)
Tenable Network Security offers data leakage and compliance monitoring
solutions for large and small networks. Scan your network and monitor your
traffic to find the data needing protection before it leaks out!