The good and bad of Linux LiveCDs (ComputerWorld)

The security threat this poses is obvious.

Yeah, it's the same as the threat posed by allowing anyone (with or without a LiveCD) physical access to the computer.

If you don't trust someone with your data, don't let them sit right in front of it.

So, for starters, if you don't fully encrypt the hard drive, do not pass go -- there is a service jumper on the MB to take a master password off, if it has a TP chip as a SecurityDevice, a Nation State, semicondutor manufacturer or small University has the tools, scanning electron u-scope, and skill to read the key right off the chip. If you do encrypt the drive you may have a few days, enough say, to get your people out of a country before the key is found and your people are shot.

But the entire HD is highly vulnerable to known ciphertext, partial known plaintext attack, especially if it is one of a tiny number of MS installs.

Tiny here is relative, a few tens of thousands, not 2^160, so you can use all the fonts, known .exe files .... as known plaintext, and its catch 22, if you have a single key the easier it is to recover that key, if you go for multiple keys you get other problems.

So you encrypt the drive, and try to destroy the data if the machine is captured, no ... I dont boot off the HD, it goes in a special trey with the write line cliped, but in any case it would take about 2 days to even make a decent attempt to erase 80GB (so residual magnetization is removed).

The only way I know to do it is to pack the dive with plastic explosive, use a kevlar bag, to retain the debris and program the machine to time-delay destruct.

So this a VERY HARD problem, as many of the world's Intelligence Agencies and Militaries well know. It is not, as presented, an issue of CD-Roms allowing users to circumvent corporate security, because that is always technical and very weak. It is because, if you physically have the machine you are 90% of the way to owning it.

Let me make one last point, many of us know that it ceases to be a secret if you tell someone, it is a conspiracy instead ;-). If you need a secure conspiracy DO NOT use computers, mobile phones or paper an make sure you talk ambiguously where you can not be overheard, preferably, as in the Vatican in Attic Greek.

Let me say this differently, anything you put in a computer should be regarded as published, and it probably will be.

But the article is a little wrong, having the LiveCD, and physical access in general doesn't give you quite everything, it's equivalent to full system administrator access, not God status.

On this machine for example, a LiveCD would let you read many of my documents, my BASH history, and so on, and there are no doubt embarassing or valuable things in there I'd be unhappy to lose. But you wouldn't instantly get my most important information, it's all secured cryptographically. My PGP key is secured with a passphrase, as are certain valuable but rarely used financial documents, a data partition and so on. The login passwords use MD5crypt, my web passwords are secured with yet another passphrase, except banking and financial sites which are not stored anywhere. Finally my remote access SSH keys are secured, and are trivially deleted from the other machines where I have access.

Windows does score points over Unix for envisioning the "compromised client" scenario early in development of their distributed filesystem. NFS servers trusted the client to report correctly which user is attempting access, while in contrast SMB / CIFS provide a per-user authentication mechanism which means if you use a LiveCD you'll still need a valid password to get access. In a corporate setting that meant you could deploy NFS only if you trusted all the clients, while SMB/ CIFS are more flexible.

NFSv4 finally provides a sane mechanism for per-user authentication, but it's not very widely deployed yet. Let's hope that Sun and NetApp are serious about this fix and do what's necessary to get it rolled out everywhere.

It's a bit hard for me to imagine that this is a serious problem, because in order to create a problem that lasts beyond a reboot, an outside attacker would have to first of all get into the machine (which is difficult since most live CDs don't by default run any outside-accessible services besides SSH), recognize that the OS is a live CD, locate the hard drive (if it's even mounted), and install malware on it. Possible, certainly, but beyond the energy level of most script kiddies -- especially when it's so much easier just to break into the computer and install malware while it's running Windows.

The media of the Live-CD is static and safe but in my eyes, the data on my disk is at risk as soon as I connect to the Internet (backups ?). In the past, it didn't stop me. Nowadays, I would consider connecting as too risky.

If you're totally paranoid lock the PCs and network in a secure area and extend the KVM to the user's desktop, or secure the server and give the users dumb thin clients.

A live CD is a very powerful tool, that can be used for good or bad. If you're running a business you probably want to restrict it to trusted technical support staff, if only to avoid well-intentioned accidents with the # prompt. And who watches the watchmen? It's a problem as old as the human world, and it's usually a mistake to apply a technical fix to a human problem.