Re: [PLUG] root shell

[JP Vossen <jp@jpsdomain.org>]

On 11/16/2016 10:04 AM, jeff wrote:
> http://thehackernews.com/2016/11/hacking-linux-system.html
> Holding ENTER for 70 seconds gives root shell (LUKS)
> Includes fix. Patch should be available already.
>
> http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html
>
> technical explanation CVE-2016-4484

And 
https://linux.slashdot.org/story/16/11/15/2150225/cryptsetup-vulnerability-grants-root-shell-access-on-some-linux-systems

But I don't see this as that big a deal.  It does NOT allow access to 
the encrypted data, and as far as I can tell the effect is not any 
different than booting from a LiveUSB, except that it's slightly easier.

We've always said that once you have physical access the game is over, 
and while 
http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html 
specifically addresses that I still don't see a big difference. Physical 
access is physical access, even if it's only virtually physical access 
(i.e., cloud).  The game is then over...

The fact is that even on a "whole disk" encrypted system, parts of it 
are not encrypted.  If you can get at those parts--however you do 
it--you can plant trojans, redirect data streams or whatever else.  This 
vulnerability makes it easier to do that and that's not good, but that's 
all it does and it looks trivially easy to fix.

Thoughts?
JP
--  -------------------------------------------------------------------
JP Vossen, CISSP | http://www.jpsdomain.org/ | http://bashcookbook.com/
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug