1

The other day I burned a Chakra Linux iso on a dvd. When I booted into a live session I was able to access all my regular data. In dolphin when clicking on the icon belonging to my /home/user partition a pop-up asked me for my sudo password. The password I entered was not my regular sudo password, but the password that belongs to the live dvd. By default, this password is always root. Using the default password I was granted access to all partitions where I have stored my data, installed Linux Mint and installed Windows 7.

I consider this to be a serious security breach. What is the point of having a password-protected account when all data can be accessed without the password by using a live dvd? Is this behaviour normal, or is something messed up on my system or is there something wrong with the Chakra distro?

  • 4
    I just want to add to the answers below that this is the same on any OS, it is not a weakness of Linux or *nix, as soon as you have physical access to a machine, that machine is compromised unless it's data are encrypted, period. This is the same for all OSs. – terdon Oct 30 '13 at 2:04
  • @terdon It is still compromised, even if the data is encrypted, because anyone can "evil maid" the encryption loader. – Chris Down Oct 30 '13 at 2:24
  • @ChrisDown fair enough, even worse then. As soon as you have physical access to a machine, that machine is compromised period. We all know the only secure computer is in a locked room, in an underground facility, is never connected to any networks and is kept permanently turned off. – terdon Oct 30 '13 at 2:30
  • I disagree with the notion that even a encrypted drive is compromised! If used correctly it's impervious to attack, even with the "evil maid" vector. Saying it's compromised against "evil maid" is no diff. than if they broke into my house and stuck a gun to my head, and saying the drive is compromised that way too. – slm Oct 30 '13 at 2:50
  • 1
    It gets even worse: with chroot you can install compromised software (rootkits) which will give you complete control of the system without the owner even noticing. – MariusMatutiae Oct 30 '13 at 11:20
8

If an attacker can boot a live CD in your environment, your environment is not secure. This is one of the reasons why physical security is so important.

As a general rule, physical access to the machine is all that's ever needed to compromise it. Unix permissions are enforced by the kernel. If you run a live CD and are root, there's no real difference than being root on your own machine; there's nothing special about your environment.

This is expected, and is normal. This is why data encryption is necessary if you want to hide your data from someone who can physically access your machine -- Unix permissions only protect you against an attacker attacking a running machine with a known permissions model, and known constraints (passwords, keys, etc) to stop an attacker from getting those permissions. If the attacker can manipulate the machine, boot into single user mode, boot a live environment, etc, then there's nothing you can do other than encrypt your data.

Encryption is a good first step, but at every step (when you are entering your authentication to decrypt the volume, etc) you are trusting the computer not to lie to you. You cannot trust the computer if you do not at least have good physical security.

Unix permissions require enforcement, and if your environment changes, that enforcement can become unexpectedly weaker.

5

This isn't a serious security breach, this is how Unix & Unix filesystems work. When you booted this live DVD and provided the password to sudo that was the password of the live distro, and not your own.

Unless you're using whole drive encryption like TrueCrypt or dm-crypt, anyone can mount your system's hard drive and see any files they want on it, either through one of the following methods:

  1. Using the native OS, booting it into single user mode
  2. Booting it with a Live distro, and mounting the hard drive as a secondary device

Additionally on hard drives that are not encrypted, anyone can take (physically remove), and mount it on another system as root, using this 2nd system to gain access to the 1st system's filesystem.

NOTE: The same can be done with a Windows drive as well.

So the primary take away for all should be that physical security is the most important aspect to keeping a computer safe!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.