12

Can the Meltdown and Spectre vulnerabilities affect also computers with encrypted home directory and usage of a VPN service? In Other words, would hackers still be able to steal passwords when encrypted transmissions and VPN services are implemented?

  • While the answers are technically correct, none of them address the fact that Meltdown and Spectre are local attacks. A VPN would only be useful against a remote adversary, and encrypted home directories are only useful while the machine is turned off--neither of which are relevant to Meltdown and Spectre. If the attacker is not on your machine, Meltdown and Spectre (to a degree) cannot be used. – Qwerty01 Jan 18 '18 at 5:05
23

Yes.

Disk encryption protects against access to the disk when it is not in use, for instance if someone steals your computer. VPN protects against anyone sniffing the wire.

Meltdown and Spectre can give attackers local access to the data, before it is encrypted.

For the system to use any kind of information, it more or less has to be available in un-encrypted form. Whenever it is available in un-encrypted form any attacker with superuser access to the computer can copy it at will.

  • 1
    "For the system to use any kind of information, it more or less has to be available in un-encrypted form. " - this isn't true. The well-known counterexample are passwords, which should never be stored, not even encrypted. Password verification relies on secure hashes. This can be Meltdown-safe; obtaining the hashed value won't give you the password which hashes to that value. – MSalters Jan 17 '18 at 10:29
  • But it is true for encrypted network traffic and disk content in general. Passwords are a special case. And nor are they encrypted; they are hashed with a one way function. – vidarlo Jan 17 '18 at 10:33
  • 4
    Passwords may not be stored on disk, but they are transmitted through networks and do reside in memory before being hashed either for storage or comparison with another hash. – JohnSomeone Jan 17 '18 at 12:17
  • 3
    And also, a password manager (one of the favourite targets in stories about Meltdown/Spectre) must store [encrypted] passwords and decrypt them at times to do their job. – TripeHound Jan 17 '18 at 14:11
  • @MSalters When it comes to VPNs, the packet encryption password must be stored, because the data is encrypted/decrypted via a symmetric key after the initial handshake. Regardless, it would be extremely difficult to find and copy a password from memory. It would be less work just to keylog. – Qwerty01 Jan 18 '18 at 5:11
9

Yes, in fact this is one of the hypothetical situations where these vulnerabilities might be attacked: when using encryption and trying to access the in-memory encryption key normally unavailable to other processes.

1

Yes. It might allow an attacker, say, by you visiting his website, to read memory of apps you have currently running. The memory content could be cookies to website you're currently logged in, saved passwords in your password manager, configuration of your VPN connection or even an encryption key you use for home directory.

On the other hand if you're 100% sure you're not going to run any 3rd party code (by downloading some untrusted software or running a browser/visiting websites), you're pretty much save. Actually that's the Microsoft's view on that matter: they assumed most Windows Server instances run in an "isolated" environment, where users put only trusted apps, so Meltdown/Spectre fixes aren't needed to be enabled there on default.

1

Yes. Encrypting your disks and network connections still leaves your entire random access memory readable by a malicious process running on the same computer. Local storage, network traffic, and RAM are 3 completely different things.

To exploit the meltdown and spectre flaws, the malicious process needs to be running on your computer. This can happen, for example if you run a program from some unknown/untrusted source, or if some webpage manages to maniplate the JIT compiler of your browser's javascript engine into running such code.

0

The vulnerabilities allow reading data from other programs, so if any other program has the unencrypted data, a malicious program can read it. So if you type your password into another program, your password can be stolen. Moreover, if you access any encrypted data, then it has to be unencrypted for you to see it, so it can be stolen. Depending on how your disk encryption works, data on your disk may be unencrypted even if you don't directly access it. If you're using end-to-end encryption, such as a VPN, well, your computer is an end, so the data is being unencrypted once it gets to your computer, so it's vulnerable.

If you have an encrypted file, and the password is not stored on your computer, and you don't ever access it, then the unencrypted data is not vulnerable (unless the encryption can be otherwise broken). But as soon as you mount an encrypted drive, it's vulnerable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.