back to article Gone in 70 seconds: Holding Enter key can smash through defense

Attackers with a little more than a minute to spare can get their foot in the door on Linux boxes by holding down the Enter key for 70 seconds – an act that gifts them a root initramfs shell. The simple exploit, which requires physical access to the system, exists due to a bug in the Linux Unified Key Setup (LUKS) used in …

  1. From the States

    Missing item in the series?

    "Debian, Fedora and are confirmed as suffering from this problem." We breathlessly await the Linux distribution that should be following "and".

    1. Michael Hoffmann
      Joke

      Re: Missing item in the series?

      Reverse Polish Notation with only those two affected?

      1. Anonymous Coward
        Anonymous Coward

        Re: Missing item in the series?

        Reverse Polish? How dare you insult dyslexic Poles!

        *Cough*

        I'll get my coat... =-Jp

        1. Spudley

          Re: Missing item in the series?

          Reverse Polish Notation... I always thought they should have just called it Hsilop Notation.

          1. Andy Miller

            Re: Missing item in the series?

            is a specialist Linux distro that uses the whitespace language as it's default shell

          2. GrapeBunch

            Re: Missing item in the series?

            Hsilop Notation - How dare you inslut dylsexic Hislop's?

            1. ben kendim

              Re: Missing item in the series?

              And how dare *you* make fun of people with lysdexia?

          3. Martin
            Happy

            Re: Missing item in the series?

            I always thought they should have just called it Hsilop Notation.

            When I were a young whippersnapper programmer, we called it shilop - easier to pronounce.

          4. W.S.Gosset Bronze badge
            Happy

            Re: Missing item in the series?

            isn't that the chap on "Have I Got News For You"?

    2. Oh Homer Silver badge
      Facepalm

      Re: Missing item in the series?

      The the most notable missing item is a link to the actual report, which states:

      Obviously, the system partition is encrypted and it is not possible to decrypt it (AFAWK). But other partitions may be not (sic) encrypted, and so accessible.

      Right, so ... just like booting from a thumbdrive, and you still have no access to the encrypted filesystem.

      Sorry, I must have missed the part where this is a "vulnerability", somehow.

      Same goes for planting malware on the boot partition, you could do that by booting from a thumbdrive, then mount any unencrypted partition from there.

      The "vulnerability" here, if there is one, is anything that isn't encrypted, not the fact that you can get shell access.

      Oh and yes, it certainly is possible to encrypt the boot partition.

      1. Ian Michael Gumby Silver badge

        @Homer ... Re: Missing item in the series?

        If you have root and while you don't have access to the encrypted partitions... there's still some dangerous stuff you can do. ... (And no, I won't even hint at it...) [Even with a machine that has an encrypted boot partition...]

        But to your point... its not *that* dangerous.

        First it requires physical access to the machine. Most linux servers are in a rack in a secured machine room. Second, you'd have to bring your own monitor and keyboard. So the odds are that if you already have physical access to the machine, you would already have root privileges.

        1. Robert Carnegie Silver badge

          Re: @Homer ... Missing item in the series?

          Shurely you only need access to the keyboard. And maybe the power off and on.

          So this could crack a kiosk, a computer in a library, maybe an ATM...

        2. This post has been deleted by its author

        3. itzman
          Facepalm

          Re: @Homer ... Missing item in the series?

          if you have physical access you can boot a live DVD, remove the hard drive...cone the hard drive...

          Its a bit like saying that in addition to jemmying the doors, you could also smash a window to get into your house...

          1. LewisRage

            Re: @Homer ... Missing item in the series?

            It's like you people are willfully missing the point.

            At a kiosk machine/library machine etc you can't pull the disk out because it's completely fucking obvious to anyone nearby that you've just unscrewed the top of the box and are in the process of stealing some hardware.

            You can't boot from a disk as they've (hopefully) locked that down/removed the dvd drive.

            With this vulnerability you can hold down the enter key and get a root shell, to any casual observer you are just using the machine as normal, whilst the reality is your up to nefarious shenanigans that you shouldn't be.

            "Clone the harddrive"... yes, by using the unexpected root shell that you've got to from this vulnerability.

            1. Destroy All Monsters Silver badge
              Paris Hilton

              Re: @Homer ... Missing item in the series?

              "Clone the harddrive"... yes, by using the unexpected root shell that you've got to from this vulnerability.

              Yeah, but, keeping with the "kiosk machine/library machine while not wearing a blue nylon jacket with 'FBI maintenance' printed on the back"...

              1) Where do you plug in that additional drive?

              2) Why would you want to clone the fricking harddrive in the first place?

              Ok, so there should be screen that demands root password after you have not managed to type in the LUKS password correctly etc. etc.

              But really.

              I have a bigger issue with the screen lock on KDE Fedora 24 which shows the actual screen for about 1/10 of a second after a series of bad password entries...

        4. Mark 65 Silver badge

          Re: @Homer ... Missing item in the series?

          If you have root and while you don't have access to the encrypted partitions... there's still some dangerous stuff you can do

          Given the breach requires physical access I could:

          1. Steal the drives and/or machine

          2. Use a lump hammer on it

          ...

          you get the idea.

        5. Halfmad

          Re: @Homer ... Missing item in the series?

          Hold on now, isn't 2016 the year of the Linux desktop? Let's not go making perfectly sensible arguments that this isn't as bad as it appears as most of them are behind locked doors.

        6. Oh Homer Silver badge
          Headmaster

          Re: "there's still some dangerous stuff you can do"

          Is there something more dangerous you can do from a busybox shell on the boot partition, than a full Linux system on a thumbdrive?

          My point is that this "vulnerability" is not new, it has absolutely nothing to do with escaping the init script, and it certainly doesn't warrant a CVE report, unless the reporter is claiming to have only just discovered that unencrypted filesystems are (shock!) vulnerable to direct access, where the init shell is only one point of access, and not even the most useful, from a hacker's perspective.

          1. jake Silver badge

            Re: "there's still some dangerous stuff you can do"

            "and it certainly doesn't warrant a CVE report"

            And it hasn't got one.

            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4484

            Does anyone commenting on this thread actually do security admin for a living?

      2. LawLessLessLaw

        Re: Missing item in the series?

        because if you have password protected the BIOS and turned off USB booting you wouldn't expect this to be possible

      3. AdamWill

        Re: Missing item in the series?

        Yeah, I'm not sure I'd describe this as a 'vulnerability' at all. Storage device encryption is not supposed to prevent people accessing a rescue shell on the system the encrypted storage device happens to be sitting in at that point in time. It's intended to prevent people accessing the *data on the encrypted device*. This 'attack' does nothing particularly significant to help you with that, except perhaps make it a bit easier to try a brute force attack.

        Even if you do consider this a 'vulnerability', the authors of the article are *massively* overplaying it.

    3. Robert Moore
      Coat

      Re: Missing item in the series?

      "Debian, Fedora and are confirmed as suffering from this problem."

      You have never heard of And Linux?

      Best distro ever. And is the new Ubuntu.

  2. Andrew Jones 2

    So the obvious question here then.......

    How long exactly has this "bug" been present?!

    1. Khaptain Silver badge

      You are not supposed to ask "that" question.....

      Mines the one with the red-faced penguin on the back.

      1. Destroy All Monsters Silver badge
        Black Helicopters

        After vigorous "research" I have been able to trace this bug back to Thompson & Richie Unix.

        WERE THEY SECRETLY WORKING FOR THE NSA ALL ALONG? WHAT DID RUBY ACTUALLY KNOW AND WHY IS OSWALD EVEN BEING MENTIONED IN THIS POST?

        Shocking deathbed testimony from a hacker dying of a mysterious cancer he obtained from a fishy sushi in an unnamed London restaurant rips the veil off the long-running UNIX conspiracy!!

        (After this message)

        1. TAJW

          Working for NSA? .... don't you realize NSA developed Linix in the first place and put all the backdoors in there from the beginning? Sheeple, sheeple I say!

          :)

  3. Criminny Rickets

    Bad user!!! BAD

    I tried this on my Linux Mint system earlier tonight. All I got for my troubles was a lot of loud beeps from my computer telling me how bad I was for trying this, before giving me the screen to enter my Cryptsetup password.

  4. seven of five

    Not the whole story:

    This is not a "find a linux box, press enter and access everything" kind of exploit.

    Said root shell is the emergency shell launched after 93 failed attempts to decrypt the filesystems and continue booting.

    It requires a linux system with encrypted boot filesystems you have terminal (not ssh) access to after a forced reboot of said system (powerfail, usually).

    As we specifically talk about systems which will never restart on their own due to the password neccessary finding one of your systems crashed for whatever reasons now requires extra-extra caution as you may well find a keylogger or trojan present.

    quick fix: adding panic=5 to your grub config.

    good fix: as per CVE-2016-4484 (effectively stop offering the rescue shell and enter a boot loop).

    hth

    1. DanDanDan

      Re: Not the whole story:

      Quite. This article is severely lacking in several key details.

      "With access to the shell, an attacker could then decrypt Linux machines". The implications are that this decryption would be easy. The reality is that you'd have access to a root shell, with an encrypted hard disk. How useful this is depends on the specific environment, but at least for me personally: as long as the "hackers" can't access any of my personal info on my hard drive, this is no worse than them bringing their own laptop and plugging it into the right sockets (with the MAC address of the network card spoofed). If the network is hardened correctly, then it's No Big Deal.

      Gaining access to an environment where you can't actually see or do anything is arguably not really useful at all.

      1. Random Q Hacker

        Re: Not the whole story:

        No big deal if I insert some firmware or modify the initramfs to contain a kernel module? Particularly if done to a vm or over remote console where I already have some connectivity?

    2. diodesign (Written by Reg staff) Silver badge

      Re: Not the whole story:

      Thanks for all the feedback - we've updated the article with more info and links to technical details of the bug and Red Hat's take on it for context.

      C.

  5. Anonymous Coward
    Anonymous Coward

    Oh I imagine the exponential increase in El Reg reader wailing and condemnations if this were a Microsoft product.

    PS Vote thumbs down if you have a pony tail!

    1. seven of five

      > Vote thumbs down if you have a pony tail!

      Well, it is not a "tail" as such. And I also have long hair...

      1. jason 7

        ...and a neck beard!

        1. Teiwaz Silver badge

          Neck beard?

          This isn't the 80's anymore, get out from behind you LCD. Most 20-something young guys are all sporting a beard these days.

          Most neck beard wearers I see out and about are not also dressed in 'tech chiq' but something eastern...

    2. frank ly Silver badge

      "Vote thumbs down if you have a pony tail!"

      You're getting them confused with Apple users. Linux users have bushy beards and baggy clothes. Microsoft users have no style at all.

    3. Alistair Silver badge
      Coat

      I have a pony, but my name is not tail.

      1. I am the liquor

        When I was a little girl in Poland, we all had ponies.

        1. hplasm Silver badge
          Happy

          When I was a little girl in Poland, we all had ponies.

          Did they have a Reverse gear?

          1. JimmyPage Silver badge
            Coat

            Re: Did they have a Reverse gear?

            That would be Italian stallions ?

          2. Speltier

            Re: When I was a little girl in Poland, we all had ponies.

            I'll make a notation to check if our pony has a reverse gear... avoiding core dumps whilst doing the checking naturally.

    4. Olius

      I've got the whole pony if you like.

    5. Sierpinski
      Trollface

      Windows Equivalent

      This appears to be very similar to the exploit where an unauthorized user can press the F8 key to gain access to the entire system.

      1. tfewster Silver badge
        Facepalm

        Re: Windows Equivalent

        s/Windows/Just about any commercial enterprise-class OS too/

        AIX, Solaris, HP-UX - If you have physical access (or access via the management interface), you can compromise the system.

        Various attempts have been made to close or narrow this (tiny) loophole*, e.g.

        - HP-UX Secure Boot wouldn't let you interrupt the boot; Unless you disconnected the boot disk and reset that option in the "BIOS" equivalent.

        - Solaris wouldn't let you enter single-user mode without a password. Unless you booted from media.

        *My knowledge may be out of date - disk encryption offers some interesting possibilities - but I'd bet that every boot security measure put in place has a backdoor. Writing off a production system just because someone lost the root password isn't an option for most organisations.

    6. David 132 Silver badge

      I can talk about Linux till I'm a little hoarse, does that count?

    7. Destroy All Monsters Silver badge
      Windows

      PS Vote thumbs down if you have a pony tail!

      Dude! How are you bell bottom trousers? Got a boombox to go with it?

      The last ponytail I saw was attached to a very aged guy re-entering computer science at uni and desperately trying to navigate the Macintosh 1. That was in 1990.

      Obviously my category of "very aged" has changed since.

      1. W.S.Gosset Bronze badge
        Headmaster

        1990? In that case, it was Macintosh 6!

  6. Anonymous Coward
    Anonymous Coward

    Now what if you don't use initramfs…

    Sounds like this is a LUKS bug than a general Linux one. I don't use initramfs, so seems incredible that it'd launch one that doesn't exist.

    1. Destroy All Monsters Silver badge

      Re: Now what if you don't use initramfs…

      LUKS has nothing to do with it. It's only responsible for the layout/conventions of the crypto stuff on the drive.

  7. Sitaram Chamarty
    Thumb Down

    Gone in 10 seconds...

    ...my good impressions of El Reg as a tech-savvy pub.

    This attack does *not* give you anything you could not get by using a USB boot, CD boot, or PXE (network) boot.

    The only situation where you *do* get more than that is in "kiosk" type situations (where the CPU/case/disks are locked away but the keyboard/mouse/monitor are accessible).

    And even then, the statement "With access to the shell, an attacker could then decrypt Linux machines" is totally wrong.

    1. Anonymous Coward
      Anonymous Coward

      Re: Gone in 10 seconds...

      "If the boot is not secured, then it would be possible to replace the kernel and the initrd image."

      However in a kiosk situation, you might have to type the entire kernel in by hand at the keyboard :-)

      1. Destroy All Monsters Silver badge

        Re: Gone in 10 seconds...

        However in a kiosk situation, you might have to type the entire kernel in by hand at the keyboard :-)

        HACKED BY SEYMOUR CRAY!

    2. Yet Another Anonymous coward Silver badge

      Re: Gone in 10 seconds...

      >And even then, the statement "With access to the shell, an attacker could then decrypt Linux machines" is totally wrong.

      Not quite totally wrong. It just needs to be modified to

      "With access to the shell, AND THE PASSWORD, an attacker could then decrypt Linux machines"

      1. Prst. V.Jeltz Silver badge

        Re: Gone in 10 seconds...

        I found this hack on windows 10 - you simply press CTRL-ALT-DEL and a world of options comes up , one of them , gives you a white text box , and if you enter the correct strings the whole machine opens up and you can access everyting!

        1. Anonymous Coward
          Anonymous Coward

          Re: Gone in 10 seconds...

          Hey on both my Window's 10 laptops the update process keeps telling me that I need to decrypt the whole damn disk and remove the encryption SW before it can update... and it keeps on telling me this... ARGH

      2. Solmyr ibn Wali Barad

        Re: Gone in 10 seconds...

        As seen on TV - shell command DECRYPT ALL FILES works without asking for the password.

        :-p

        1. David 132 Silver badge
          Coat

          Re: Gone in 10 seconds...

          As seen on TV - shell command DECRYPT ALL FILES works without asking for the password.

          But that only works if you have your terminal font size set to at least two-inch high characters, and if you have the NMap sourcecode scrolling by in another window.

  8. jake Silver badge

    For more (including the fix), see:

    http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html

    Note that this isn't a Linux (kernel) problem, per se; rather, it's a scripting error.

  9. Unicornpiss Silver badge
    Meh

    Bummer...

    But there will always be one more bug or vulnerability, regardless of what OS it is.

    If we're lucky, there are a few in the universe as well, that we can exploit to go faster than light, but I don't know what patch schedule the universe is on...

  10. herman Silver badge

    Bullshit story

    Some people just don't understand how disk encryption systems work.

    With 'whole disk encrypttion' the /boot partition has to be unencrypted, otherwise the machine cannot boot - duh.

    You can boot a computer up various ways and get a console - another duh.

    The rest of the disk is still encrypted and the data is still unreadable and safe. So there is no problem, this is how it is supposed to work.

    1. sabroni Silver badge

      Re: The rest of the disk is still encrypted

      jake linked to this article http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html

      As it points out in the section marked Impact there may be other unencrypted partitions attached to the system, the hacker could compromise the boot partition for later exploitation, the encrypted disk could be copied for brute forcing at a later date or the attacker could just blat the encrypted disk.

      1. Preston Munchensonton
        Alert

        Re: The rest of the disk is still encrypted

        As it points out in the section marked Impact there may be other unencrypted partitions attached to the system, the hacker could compromise the boot partition for later exploitation, the encrypted disk could be copied for brute forcing at a later date or the attacker could just blat the encrypted disk.

        If the attacker has physical access to the system, why the fuck am I more worried about whether he could just blat the disk than the fact that the asshole has physical access?!?!

        Anyone who falls to this bug likely has WAY bigger issues than whether someone can wipe an encrypted partition.

        1. Danny 14 Silver badge

          Re: The rest of the disk is still encrypted

          Library machines tend to be more useful when people have physical access to them.

    2. Anonymous Coward
      Anonymous Coward

      Re: Bullshit story

      Actually it is possible to boot the whole encryption way..

      There is an option in /etc/default/grub called GRUB_ENABLE_CRYPTODISK which should be set on for it work. Then GRUB will ask for your password to access the boot partition to load the config file and stuff.

      The only drawback is that you have type the password two times, once in grub and second while the initramfs is mounted.

      Tested full disk encryption on archlinux, works perfectly.

      1. Skrypton

        Re: Bullshit story

        Forgot to mention, this drawback can be mitigated by using a keyfile.

  11. Anonymous South African Coward Silver badge
    Coat

    Article is sorely lacking on details... :(

    jacket --> pub time

  12. Anonymous Coward
    Anonymous Coward

    I dont

    Believe in LUKS just cause and effect.

  13. Anonymous South African Coward Silver badge

    And that's 70 seconds of my time wasted as well...

    Ah well.

  14. Anonymous Coward
    Anonymous Coward

    This is not really world shattering..

    * This just gives you access to the initramfs shell, it does not actually give you access to the encrypted partition. The best they can do is bruteforce your password for access but as long as you have a decent password, it won't work or use some basic tools built into it.

    * This does not work if the boot partition is encrypted or does not exist, thus being in the root partition itself happens to be in the encrypted partition. Technically having initramfs inside the partition will still render this bug useless.

    * There's nothing wrong with the actual encryption, just some small error in a config file.

    Why are news sites making a big deal over this?

    1. Skrypton

      Re: This is not really world shattering..

      Rephrasing my second point

      * This does not work if the boot partition is encrypted or does not exist, thus being in the encrypted root partition. Technically having initramfs inside the partition will still render this bug useless.

  15. Joerg

    The myth of opensource and Linux being secure....

    This is far from a bug. it clearly is a backdoor designed on purpose to be there that way. One can only wonder any many backdoors could be active in a Linux system that only a few know anything about.

    1. Nunyabiznes

      Sarcasm?

    2. hailbaal

      Well, no it's not a myth. I'm not even sure this is a bug. You can log in in single user mode in most distributions, that's why they offer drive encryption. The attacker that has physical access still can't do anything (as in, can't grab files) if the drive is encrypted. The attacker can do harm to the installation, but that's it. Everything else is still secure. The attacker has physical access and might as well grab the drive and attach it to a USB to SATA converter. Does pretty much the same thing.

    3. sven257

      No. One cannot only wonder, but one can look into the source, too. That's still the point of open source.

      Windows users should be scared by the amount of bugs that are being found every day in open source. Not because these are bugs, but because bugs are a part of all software developments. Just like people have their flaws so does software, and the more complex the software is the higher this number gets. It's a fact they need to open their eyes to.

      To believe Windows and closed source to be secure in comparison to open source is naive - about as naive as closing your eyes and to believe the world and its flaws has suddenly disappeared.

  16. Alistair Silver badge
    Coat

    initramfs (or initrd as the case may be)

    Really, the only *issue* here is that they can copy the encrypted volumes or *possibly* install a keylogger. In any case, one has to have one's hands on the hardware (or VM control surface), and one has to have a tailored piece of software to install on the machine. -> at this stage one would be installing a kernel module to shanghai the keyboard input, thus "tailored".

    Many distro's are getting into the habit of *not* mounting /boot during runtime unless called for (updating the kernel, rebuilding initramfs or initrd) to avoid having stuff dropped in there that does not belong due to drive by or 'stupid user issues'.

    Systems on the DC floor? If you've made it to the console level or have your hands on the hardware, the game is already over.

    Not so much a "massive security bug" as it is an "oh, crap, forgot to take that line I put in just in case out".

  17. jms222 Bronze badge

    Screwdriver

    This is really what you can do with a screwdriver (or maybe optical drive or USB port if it might boot off those) but now just access to the keyboard with no tools needed.

  18. GrapeBunch

    Forest

    So it's 70 seconds, regardless of the key-depressed-repeat-rate and the key-depressed-repeat-delay?

    Standing back, this looks like another way to say buffer overrun. I'm not even sure why that was ever a thing. It's like you dimension an array to 100, but if a process contrives to ask for record 110, it's not a computer room anymore, it's a computer shroom. Before you press the down arrow, I'm not criticizing linux, but I might be criticizing (certain implementations of) a programming language.

    1. Will Godfrey Silver badge
      Angel

      Re: Forest

      Yes, but it's only a problem if the programmer is also a buffer duffer.

  19. Sam Therapy
    Trollface

    Not too many penguins around here today

    That's all.

  20. nagyeger

    break=overthere

    Shocking, you have ze physical access, you can interrupt ze boot process....

    Just saying break=sidewayz or various real options or (my old favourite which used to work, but doesn't do so well these days was init=/bin/bash).

    Just a few days ago I used this to add myself to /etc/passwd before letting the system reach multi-user mode.

    I must admit it's a bit embarrassing for whoever wrote the comparisons in that bootscript, but this is really nothing to see, move along...

    1. AdamWill

      Re: break=overthere

      Well, you could theoretically have set up a bootloader password to try and prevent people fiddling with the boot process. Anyone who doesn't do that, though, certainly doesn't have any kind of increased attack surface due to this so-called "vulnerability".

    2. AdamWill

      Re: break=overthere

      Having thought about it a bit more, really the only plausible case I can come up with is if you decided you wanted to prevent unauthorized folks accessing your system but you didn't want to lock the whole thing up, so you just locked away the main system but left the monitor and keyboard on your desk. Then you misunderstood the purpose of disk encryption and decided to use it as an access control mechanism, believing that the decryption prompt on boot would effectively prevent anyone accessing the system at all (assuming you always locked the screen or shut it down when walking away). And, probably (I'm still thinking about this bit) realized you had to set a bootloader password for this approach to be 'effective'.

      Of course, what you should actually have done is set a firmware (BIOS) password.

  21. Cosmin Roman
    Coat

    wonder ...

    .. what Linus would have to say, though. Choice words, surely :)

    1. jake Silver badge

      Re: wonder ...

      Quite honestly, I doubt Linus even noticed this in passing. It's kinda outside his normal jurisdiction. If you're seriously curious, you could email him and ask; it's not like his email address is top secret or anything.

      Note that I don't actually recommend sending that mail ... I suspect his answer (if any) would be along the lines of "Why are you bothering me with this crap? If you had done even 30 seconds of the most basic of research, you would know that my name is nowhere near that codebase."

  22. Havin_it

    initramfs shell?

    So, um, what if you don't use an initramfs? I don't. Just wondering ...

  23. arctic_haze Silver badge
    Childcatcher

    I've discovered the worst Linux vulnerability

    If you have physical access to the keyboard and the root password, you can do virtually anything!

  24. This post has been deleted by its author

  25. sven257

    Hammer News Incoming

    "Gone in 1 second: Taking a hammer to your computer - The simple exploit, which requires physical access to the system, exists due to a bug in Linux security experts who feel the need to make big news out of every vulnerability. ..."

    I get the importance of the bug and also that it needs fixing, but can we please at least make a distinction between security holes, which require physical access and those that don't? Anyone who can get this close to the computer may as well destroy it by conventional means, steal it or replace it with another depending what the true nature of the attack is. That these bugs get the same attention as those, which can be triggered over a network, is simply unreasonable, because they are far less critical in real life. Security holes in a network can get exploited by millions of people and with bots are we seeing the numbers going into the hundreds of millions. You sure don't get that many opportunities with physical access, do you now?

  26. David Pollard

    Is this what they call ...

    ... forced entery?

  27. Anonymous Coward
    Anonymous Coward

    This says something about why Linux still isn't viable for the masses

    One of the more popular arguments against this being an exploit of import is: 'it requires physical access to the machine.' What sort of benefit do you think full disk encryption provides if not protection against personae non gratae with physical access to hardware? If you're concerened about the server side of things, well that might be another matter; if we assume a server to be always on, then the disks are already decrypted and data is always potentially open to an intruder in the room. But the brunt of any cryptsetup exploit will be felt on personal computers, business workstations and kiosk machines, because that is exactly what cryptsetup was meant to protect.

    I'm not sure whether the majority of comments deprecating this discovery stem from ignorance of cryptsetup's actual purpose, or whether they're misguided attempts at downplaying a weakness in a goup's technological investment... In either case, it provides a hint as to why Linux is not taken seriously on the desktop, since there exist a large number of users who apparently don't take the desktop side seriously at all.

    1. jake Silver badge

      Re: This says something about why Linux still isn't viable for the masses

      Using that kind of logic, there are no serious desktop operating systems.

      I'm actually OK with that assessment ;-)

  28. Steve Wysham

    Why hold down the enter key?

    I use this disk encryption. If I walk away from my computer for a time it will fall into a shell prompt. No effort required.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019