Marc Briceno - Director, Product Management
Last week saw the release of the “Evil Maid” attack targeting the open source TrueCrypt full disk encryption product.
The “Evil Maid” attack was implemented by Invisible Things Lab, whose principal is well respected in computer security circles for her work creating the “Blue Pill” virtualization malware.
As with the “Stoned Boot” attack that was announced earlier this year, “Evil Maid” is fundamentally malware. Neither attack demonstrates flaws in the underlying cryptographic security of any other full disk encryption product.
While disk encryption products such as PGP® Whole Disk Encryption can do very useful and desirable things to enhance your security posture - such as protect the data on your computer’s hard drive - full disk encryption by itself does not protect your computer from malware, viruses, or spyware.
Most users realize that it is unwise to enter their password into a computer given to you by an unknown individual. Once an attacker has installed a new operating system on your computer, the computer may still look like your computer, but it is no longer yours. It is now the attacker’s computer. If you type your password into the attacker’s computer, your password will soon be theirs as well.
No security product on the market today can protect you if the underlying computer has been compromised by malware with root level administrative privileges. That said, there exists well-understood common sense defenses against “Cold Boot,” “Stoned Boot,” “Evil Maid,” and many other attacks yet to be named and publicized.
PGP® Whole Disk Encryption offers a range of options that will make it difficult for the “Evil Maid” to clean out your laptop:
Much of the malware found in the wild will capture your passwords, be that the login password to your laptop or the website password for your bank. Two-factor authentication should be your first line of defense against password loggers.
PGP® Whole Disk Encryption has supported the use of smartcards from day one. If you use a smartcard to authenticate to PGP® Whole Disk Encryption, the ”Maid” will learn your smartcard’s PIN, but without the smartcard in your wallet or the cryptographic USB token on your keychain she cannot use this information to log into your laptop to compromise your data.
We also support a protected path smartcard reader with which the user enters the PIN into a PIN pad on the smartcard reader directly, depriving the maid of both the PIN and the token. Our customers with higher security needs have standardized on such readers. Customers with even higher security needs disabled the USB ports on their systems years ago by squirting gobs of epoxy glue into the connectors. Thereby preventing the “Evil Maid” attack. Those same customers typically power up their computers only in TEMPEST shielded rooms, because they know that every time you press a button on your laptop keyboard it emits a small amount of radio frequency radiation which with the right equipment can be picked up from the hotel room across the street.
There are many lessons to be learned from the, often elegant, attacks against some implementations of full disk encryption that have garnered press coverage over the last year. Starting with “Cold Boot” last Winter, “Stoned Boot” this Summer, and “Evil Maid” this Fall. The lessons are far from novel, but they deserve repeating:
- Passwords are less secure than two-factor authentication.
- If the operating system or hypervisor into which your computer first boots has been taken over by malware, so have all guest operating systems or applications that follow in the boot sequence.
- There is no “silver bullet” security solution that will meet the security needs of all users in all circumstances. Talk to a qualified security professional that can help explain the available risk mitigation options appropriate for your unique needs.
- Don’t use encryption products that claim “unbreakable” security or that don’t publish their cryptographic source code.
- While no technology is perfect, you will be much safer encrypting the data on your laptop and in your emails than leaving everything in the clear.