2

I was shocked to discover that my password could be easily reset via the command line. Does that mean anybody with physical access to my machine could reset the password and read the encrypted contents of my home folder? If so, how do I prevent it from happening?

2 Answers 2

3

Does that mean anybody with physical access to my machine could reset the password and read the encrypted contents of my home folder?

No, home encryption is linked to that password so if I stole your computer and changed the user password, I wouldn't be able to easily (more on that later) decrypt the data.

That said, access to recovery mode means getting root on the disk and as root I can script anything to run in the background... I could implement a key-logger or other nastiness to sniff out your password as you entered it, or access the data once decrypted without you knowing.

You can disable recovery mode or set a password on grub to prompt the user if they want anything but the standard option. Of course somebody could slip a bootable USB stick or DVD in and mount the disk externally so you should also change the boot order (and password protect BIOS) to only boot to the first harddisk.

That stops the laziest hackers. If somebody has a screwdriver with them, a laptop and a SATA→USB bus, they can just pop the drive out and mount it on their laptop, change your password and put everything back. I reckon I could do the whole thing in well under five minutes. Even less on a laptop as their drives are often more accessible.

If you want to defeat me, you'll need to encrypt the whole thing at install-time. That means a reinstall and you needing to enter your password in each time.

But even then, as dobey says, if I really want the data, I'll clone the disk as a raw image file (~20minutes), and use an EC2 cluster to crack it (hours, days, weeks)... Or a $5 wrench and your fingers (seconds)...

enter image description here

4
  • Thanks, this is the kind of information I was looking for...and what do you mean by "mount it on their laptop, change your password and put everything back."? Why would they need to change my password and put everything back? If mounting it on their laptop is the necessary step to decrypt the home folder (because I assume that's what you mean by that), why change the password? Dec 17, 2014 at 19:13
  • I mean, I guess that when they attempt to change the password, they will no longer be able to access the home folder, since it is linked to that password, unless they have the passphrase...am I correct? Dec 17, 2014 at 21:15
  • I meant that as an alternative to mounting the installed media under a Live environment (which would give root access), you can use a real install on another computer. An Ubuntu laptop and a USB disk caddy device would make that very easy.
    – Oli
    Dec 17, 2014 at 22:40
  • That is correct... Unless (as I go onto say) they implement some sort of keylogging on the first visit so they can get your passphrase when you next login. It would be impossible for you to detect. They could even take a raw dump of the whole disk the first visit and then unlock it remotely once their keylogger emails out your passphrase. I love thinking evil >:D
    – Oli
    Dec 17, 2014 at 22:41
1

Use full disk encryption instead. And limit physical access to your machine.

If someone has physical access to your machine, they could simply steal your disk and take it elsewhere to eventually break the encryption as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .