PaulSpoerry.com

The Evil Maid Attack is an attack type against whole system disk encryption in a form of a small bootable USB stick image that allows to perform the attack in an easy “plug-and-play” way. The whole infection process takes about 1 minute, and it’s well suited to be used by hotel maids.

The Invisible Things blog goes into great detail on how most whole disk encryption is vulnerable in a relatively simple way. The scenario we consider is when somebody left an encrypted laptop e.g. in a hotel room. Let’s assume the laptop uses full disk encryption like e.g. this provided by TrueCrypt or PGP Whole Disk Encryption. Many people believe, including some well known security experts, that it is advisable to fully power down your laptop when you use full disk encryption in order to prevent attacks via FireWire/PCMCIA or ”Coldboot” attacks.  So, let’s assume we have a reasonably paranoid user, that uses a full disk encryption on his or her laptop, and also powers it down every time they leave it alone in a hotel room, or somewhere else.

Now, this is where our Evil Maid stick comes into play. All the attacker needs to do is to sneak into the user’s hotel room and boot the laptop from the Evil Maid USB Stick. After some 1-2 minutes, the target laptop’s gets infected with Evil Maid Sniffer that will record the disk encryption passphrase when the user enters it next time. As any smart user might have guessed already, this part is ideally suited to be performed by hotel maids, or people pretending to be them.

So, after our victim gets back to the hotel room and powers up his or her laptop, the passphrase will be recorded and e.g. stored somewhere on the disk, or maybe transmitted over the network (not implemented in current version).

Now we can safely steal/confiscate the user’s laptop, as we know how to decrypt it. End of story.

Read the rest of this entry »

Geoff Chappell published an article explaining how the 4GB memory limit for 32-bit Windows (he is writing mainly about Vista) is more of a licensing preference than an architectural limit. The article outlines how Chappell unlocked his system to use all the memory that is present, but cautions that such hackery is ill-advised for several reasons, including legal ones.

“If you want [to be able to use more than 4GB in Vista] without contrivance, then pester Microsoft for an upgrade of the license data or at least for a credible, detailed reasoning of its policy for licensing your use of your computer’s memory. … [C]onsider Windows Server 2008. For the loader and kernel in Windows Vista SP1 (and, by the way, for the overwhelming majority of all executables), the corresponding executable in Windows Server 2008 is exactly the same, byte for byte. Yet Microsoft sells 32-bit Windows Server 2008 for use with as much as 64GB of memory. Does Microsoft really mean to say that when it re-badges these same executables as Windows Vista SP1, they suddenly acquire an architectural limit of 4GB? Or is it that a driver for Windows Server 2008 is safe for using with memory above 4GB as long as you don’t let it interact with the identical executables from Windows Vista SP1?”

Read the full article here.

Back in 2006 Apple launched its “Get a Mac” ads, and they were amazing. Even being a PC developer I thought “holy hell those are funny”. Microsoft seemed to be attempting to fight back with it’s Laptop Hunter ads. The ads show how an equivalent PC laptop costs less than it’s Mac counterpart (which is true)… well, Apply has decided to retaliate directly, in two new ads.

The first one, “Top of the Line,” is notable because it employs the one-and-only Patrick Warburton as a high-end PC: “When you’re ready to compromise, call me,” he says.

The second ad, “Surprise,” takes a different visual approach (basically, it has John Hodgman playing “Mission: Impossible” in an attempt to get a nice lady to switch over to a PC), and comes to the same conclusion as “Top of the Line”: Windows PCs are virus-laden and slow.

The bits are available now! WINDOWS 7 versions available for download on TechNet and MSDN download sites no longer carry the Release Candidate (RC) label. While the software will not go on general sale until October 22, the full version of Windows 7 is now available to hundreds of thousands of potential users. There’s still no formal announcement in TechNet’s news area, which still talks about RC, the final files are appearing in the subscribers’ download area.

All flavors area available including Windows 7 Home Premium, Professional, and Ultimate editions, subscribers can even download the Home Basic and Starter editions, which won’t be for sale to US consumers.

I grabbed my copy yesterday and it was the smoothest, fastest Windows install today. So far I’m pretty pleased.

Windows7 Upgrade Chart

Earlier today GeekSmack.net “confirmed” that Windows 7 was set to RTM (release to manufacturing) on July 13. This coincides with Wzor’s “unconfirmed” rumor last month. A few minutes ago sources close to the company confirmed to Neowin that Windows 7 is indeed set to RTM on July 13. The date, July 13, also coincides with the kickoff of the Worldwide Partner Conference that is taking place in New Orleans.

Note: RTM and GA (General Availability) are two totally different phases. RTM is typically the final build before Windows 7 hits general availability later this year. RTM is provided to manufacturers so they can work out any bugs with hardware devices. General availability is scheduled to launch on October 22. RTM DOES mean that those with subscriptions to TechNet, MSDN, etc will be getting the RTM build on July 13th!