[Bug 1506995] Re: Ubiquity facilitate attack on crypto LUKS
Dimitri John Ledkov
launchpad at surgut.co.uk
Tue Dec 1 21:41:09 UTC 2015
this doesn't facilitate any attacks, until proven otherwise.
please note that during installation, there is no valuable data on disk
anyway, or in other words, all data written can be pre-calculated as the
predictable copy of the squashfs is done.
please demonstrate how you can recover encryption key based on the just
installed, yet otherwise untouched, machine.
** Summary changed:
- Ubiquity facilitate attack on crypto LUKS
+ Ubiquity uses /dev/null when setting up encrypted swap
** Changed in: ubiquity (Ubuntu)
Status: Triaged => Opinion
** Changed in: user-setup (Ubuntu)
Status: Triaged => Opinion
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to user-setup in Ubuntu.
https://bugs.launchpad.net/bugs/1506995
Title:
Ubiquity uses /dev/null when setting up encrypted swap
Status in ubiquity package in Ubuntu:
Opinion
Status in user-setup package in Ubuntu:
Opinion
Bug description:
In Ubiquity's script/user-setup-encrypted-swap, the crypt partition is
zeroed. This leaves it more vulnerable to attacks. The attacker knows
the partition is zeroed and can more easily find the encryption key.
The included patch solves this issue, but this can also be done in a
faster way by using openssl.
Patched lines:
dd if=/dev/urandom of=$device bs=16M seek=1 2>/dev/null || true
Alternative approch:
openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128
count=1 2>/dev/null | base64)" -nosalt < /dev/zero | head -c $size |
dd of=$target
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1506995/+subscriptions
More information about the foundations-bugs
mailing list