full-disclosure - Re: round and round they go

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 23 Feb 2008 13:57:30 +0100
From: niclas <lists@...enritter.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: round and round they go

> hrm. sigh. Normal moles not being able to grasp trivial knowledge.

*cough*

> Airports are duh known conduits of business travellers with lots of
> data,

first question: do those travellers use encryption? from my experience,
most people are just ignorant when it comes to security.

how many notebooks are stolen to do industrial espionage? any statistics?

anyway, you're right - if they do use encryption and if they felt safe,
they have to feel a little less safe from now on.

that means: if in doubt, you should not carry too much important data on
your notebook. (a VPN access might help...)

and you might just turn your notebook OFF, instead of putting it to sleep.

> thus increasing the possibility of targeting a more valuable
> target. So your statement that only ordinary criminals steal at
> airports is shortsighted. If anything a common criminal isnt going to
> try and steal at a place with a fucking million security cameras
> around.

hmm, ok, who would do so? would you say, it is easy to grab a notebook
in an airport lounge and leave the airport before anyone notices or
security folks get after you?

> You hardly need a barrel of liquid nitrogen - If you could summon not
> a barrel but more of a can of  clue you would be better off.

ok, so what you have to do is: grab the notebook while it's powered on
or in an ACPI sleep state. (maybe hit the victim in the toilet or
something.)

get out of the airport into a car and disappear quickly. in your car you
might have a *can* of liquid nitrogen or just a bunch of screwdrivers
and an ice spray. (the DRAMs might not be easily accessible.) you need a
computer with the same slots and be sure that the DRAMs have compatible
timing... and gloves, by the way...

possible, but complicated.

still, there are comparatively *simple* countermeasures. use glue. use
TWO encrypted drives (one for your personal data and one for your secret
business data). use an RFID- or bluetooth device to secure your
notebook. and then there are anti-tempering methods. i have heard there
are secure memory modules which erase themselves quickly...

or just don't let them snatch your computer!

n.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/