I’m setting up FDE and wonders which one is better. “LVM over LUKS” or “LUKS over LVM”? Or something else? Does one is definitely better then the other? What are your preference?
Thanks.
I’m setting up FDE and wonders which one is better. “LVM over LUKS” or “LUKS over LVM”? Or something else? Does one is definitely better then the other? What are your preference?
Thanks.
For secure boot bypasses I could only find BlackLotus is the only one capable to do this. I would like to have more details to support the claim “Secure Boot has been hacked in a minute.” Also, I would like the explanation on secure boot is a false sense of security and points to suport such claim as BlackLotus is the only publicly known malware to bypass secure boot.
However, I do firmly believe that there ia no reason that servers can’t use FDE as they are no differ than other typical computer.
EDIT: forgot the “boot” for secure boot
I think people tend to get hung up on where you store the key material for a server. Hardware token and TPM being two options that are less secure, but network bound disk encryption is supported as well as a combination. So you could have it require the network key as well as the matching PCRs from the TPM for the proper software load before it will unseal.
Hardware token being less secure?
If I steal the server I have the token, unless someone is physically going to unlock the server every time you reboot which is not realistic.
TPM has been bypassed. Researches found a lot of laptops where you can just attach wires to the TPM communication lines and you can just listen and wait for the TPM to spit out the key.
It’s a hardware attack so game over. But still worth doing especially on servers and desktops because then it’s still much more of a skilled attack than someone just stealing the drives. Especially servers with their front drive bays you can literally just pop the drive. And if the drive dies and you can’t erase it, it’s fine, you can throw it away and not care because it’s FDE so you can just throw away the keys.
The secure boot vulnerability was shown on a lenovo laptop. I’ve found https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/, but I’m not sure whether it’s the same thing I was talking about. The attack abused the fact that the TPM chip was outside the CPU so it was possible to read the keys in plain text by just putting a clip on the chip. The laptops in the ESET article seem fairly new so I would expect them to have TPM inside the CPU.
I recommend reading “threat model” page on Heads OS’ website. Secure boot can be disabled in the UEFI settings which can be accessed by unplugging the CMOS battery to reset the UEFI password. Undoing a few screws takes a few seconds so the bottleneck would be how fast you can upload your fake login screen onto the drive.
Servers can use FDE obviously but using them becomes highly inconvenient if you enable that. In order to boot you need to decrypt the drive but how are going to connect to the server if it hasn’t booted yet? One solution is to only boot the server when you have local access. The issue rises when your server crashes. Alternatively you can either start sshd early in the boot process at which point it isn’t really FDE or have some kind of KVM which just shifts the issue to a different device.