Schneier on Security

Roger • October 24, 2005 4:42 AM

@scosol:

This article originally appeared some months ago in Security Focus. In response to criticism in SF blogs, he posted a “clarification” which answers several of your objections. Specifically:

Ah my favorite- blindly installing vendor-supplied updates before running them through full QA and reviewing peer reports of their usage is conducive to neither security nor availability.

In his clarification, Mark noted that this is because he is a hotfix beta-tester and has already tested them. He does recommend other uses pre-testing before installing hotfixes. However, I do not! OK, pre-testing is pretty important for the corporate intranet, and appropriate for expert home users. But for the average home user, that is an excessive complication, and one which is in fact rarely necessary unless you have a very unusual configuration. For the typical non-technical home user it is safer to rely on automatic updates, which in practice amounts to same day installation.

It takes five passwords to boot up my laptop and check my e-mail.
Since he makes no mention of disk-level encryption on his laptop, I assume he’s not using any- thus with physical access (the only time one would be confronted with his 4 host passwords), all data on it is of course easily accessible. Perhaps he should switch to a 10-password scheme?

Actually, one of his 5 passwords IS indeed a disk-level encryption scheme. He’s not quite clear here but that seems to be the one which gets the 50 character (10 word?) passphrase since the others don’t take such long passwords. The other passwords are a BIOS boot password, windows syskey, Windows logon, and his email password. The only one which comes even into the ballpark of paranoia is the syskey password.

A word of explanation on syskey: the windows syskey is a method of encrypting the windows security database, so that if a worm somehow obtains admin privileges, or even if a drive is mounted outside its own operating system, it is not possible to mount a dictionary attack on passwords. Installing a syskey is done by default on recent windows systems but requiring it to be entered at bootup is optional and hardly anyone does it, even though Microsoft specifically recommends it be done for any system that an opponent could obtain physical access to. (Not so good for servers as the machine then cannot reboot whilst unattended.) Arguably, it is a teensy bit paranoid for this setup since presumably the only passwords in the SAM are his own accounts, which presumably are already have strong password and are not vulnerable to dictionary attacks. But if he has other user accounts on the machine then especially for a laptop it is definitely a good idea.

The BIOS boot password on laptops is a reasonably robust method of preventing tampering. Certainly it can be overridden, but on a laptop doing so quickly without damaging the machine and/or leaving obvious traces is technically fairly challenging, certainly out of the league of the typical sneak thief or corporate spy. Unlike a desktop machine on a modern laptop it is usually not possible to simply reset the password (which in any case makes it obvious what has happened). For example PWCrack.com offers a BIOS password extraction service, but it requires that you first desolder the (surface-mount!) chip from the mobo yourself (not something that can be done in 5 minutes!), ship it to them, then they have a 2 day turn-around time, and finally the chip is usually unusable after they have extracted the password so you have to buy and program a replacement chip which the manufacturers will not supply, so it ends up looking different.

Unless a system needs to boot unattended you also might as well have a BIOS password since it’s very cheap and does add a significant hurdle. BIOS boot passwords also don’t need to be super-strong (and hence can be easier to remember) since they are not subject to dictionary attacks while the machine hasn’t booted, and it can’t be booted without knowing the password. While you’re at it, also set the BIOS admin password, which will a) prevent resetting of the boot password and b) prevent a virus from reflashing the BIOS and turning your laptop into a very expensive foot-warmer. This BIOS admin password does need to be strong, but that’s OK since you use it very rarely, so write it down and stick it in the safe or wherever you keep your passport.

This is a reasonably secure system. The disk encryption with a strong passphrase means his data is rock solid safe in the event the laptop is stolen (although I hope he also has backups!); the presence of the BIOS password makes it much more difficult for an opponent with physical access to install a keylogger which could then be used to attack the disk encryption. Strong and independent windows and email passwords mainly are protection from on-line attacks. Syskey is mainly useful here if someone without paranoid security practices also has an account on the laptop. The fact that so many different passwords are required to achieve all this is a problem with the architecture, not his paranoia level.

Incidentally it seems to me that there is actually at least one password missing here: the dialup password. Maybe Mark trusts Windows protected storage to be strong enough to protect that, since it is a fairly minor secret, and is encrypted with a key derived from his password (which presumably is strong). Personally, I would not trust it, since it will give up this data for the asking while I am logged on, and thus may be vulnerable to viruses, worms etc.

My favorites:

I keep my PC’s turned around so I can tell if anyone has installed a hardware keylogger.
HAHAH as if that’s the only place one could be placed. I’m imagining this guy’s home life- “Who turned the computer around?!?!? Johnny? Sally? Answer me!!!!”

Well, yes I agree it is a bit paranoid worrying about hardware keyloggers on his home network.
Having said that, while it is theoretically possible to put a hardware keylogger in many places, all the ones currently available off-the-shelf — and hence available to any old bottom-feeder for quite modest prices — require either replacement of the entire keyboard, or else are installed between the keyboard port and the end of the keyboard cable. I guess the FBI could come in and install one inside my existing keyboard, or pick the padlock on my desktop case and install one inside the case. But I’m not worried about the FBI. If I was worried about this at all, my concern would be a flatmate or cow-orker slipping a forty dollar gadget on the end of the keyboard cable.