This presentation provides a critical analysis of the current state of full disk encryption (FDE) and its effectiveness, particularly against well-resourced adversaries like law enforcement agencies. The speaker, an Arch Linux user and activist with anti-repression insights, delves into various FDE implementations across smartphones (iOS, Android), Linux, and Windows (BitLocker). Key attack vectors discussed include brute-forcing, exploiting unencrypted boot components, cold boot attacks (with historical context and modern bypasses), and Trusted Platform Module (TPM) vulnerabilities (such as sniffing and unmeasured boot components). While FDE is a vital defense, the talk concludes that it's often "not really good" without advanced configurations (e.g., Secure Boot, pre-boot authentication, hardware memory encryption) and remains susceptible to non-technical methods of coercion employed by authorities.
Full Disk Encryption: Still Not Really Good?
0:38 Motivation and Threat Model: The speaker began exploring FDE after acquiring a new laptop, driven by their anti-repression work and experiences with police raids targeting friends, highlighting law enforcement as a significant threat.
2:24 Law Enforcement Capabilities: Police have extensive privileges, including physical access to devices (house searches), ample time to wait for exploits (months or years), significant financial resources to purchase unlocking tools (e.g., Celbrite), and often face no consequences for damaging devices during analysis.
Modern smartphones are encrypted by default, but tools like Celbrite can often bypass this.
4:41 iPhone Support Matrix (Leaked): Reveals brute-force capabilities for iPhones up to model 11, while newer devices (iPhone 12+) are resistant to pin brute-forcing. Exploits are often effective only "after first unlock" (AFU), meaning the device must already be decrypted.
6:54 GrapheneOS: Stands out as a more secure Android option; law enforcement has reportedly been unable to unlock/analyze GrapheneOS devices. Its "auto-reboot" feature (which re-encrypts the device after inactivity) has influenced Apple and Android to implement similar features.
9:22 Chip-Off Method: A physical attack where the flash chip is removed from the device, cleaned, and then connected to an adapter for data extraction. Its success depends on whether the device uses a TPM or similar hardware-backed encryption.
11:21 Interim Conclusion: Full encryption on smartphones is generally not sufficient due to these bypasses. The speaker recommends using disappearing messages.
12:01 Unencrypted /boot Partition: Ubuntu's default encryption leaves the /boot partition unencrypted, making the kernel and initrd vulnerable to backdoor attacks (e.g., injecting malicious commands into the init script).
17:22 Encrypting /boot: While possible with GRUB, the GRUB EFI application itself remains unencrypted and can still be backdoored.
18:44 Secure Boot: Can verify the integrity of unencrypted code (like the GRUB EFI application) by signing it with a custom Certificate Authority (CA). However, it requires setting a firmware password to prevent attackers from simply disabling it. A key limitation is that disabling Secure Boot can go unnoticed by the user.
Concept: Full disk encryption keys temporarily remain in RAM after power loss, especially when cooled (e.g., with cool spray).
21:36 Attack Method: Involves freezing RAM, briefly removing power, and then booting from a USB stick to dump memory and extract the AES key (demonstrated with a 2008 video).
24:00 Hardware Mitigation (MOR bit): Introduced in 2018, this "Memory Overwrite Request" ensures RAM is wiped on improper shutdown.
24:51 MOR Bit Bypass: Fsecure demonstrated in 2018 how to bypass the MOR bit using a programmer to modify the NVRAM, re-enabling cold boot attacks on modern hardware (demonstration shown).
28:35 Mitigations: Turning off the device completely (instead of suspending), using hibernate (which encrypts RAM to swap), devices with soldered RAM, hardware memory encryption (e.g., Intel TME), and strong firmware passwords for boot settings. Cops are known to perform these attacks on high-value targets.
Definition: A dedicated security chip (version 2.0 is current standard) present in most modern devices, providing a secure random number generator and private key storage.
FDE with TPM: The FDE key is stored within the TPM and can be protected by a PIN, preventing decryption if the disk is removed or booted from a different device. A recovery key is essential if the TPM or motherboard fails.
34:43 Measured Boot (PCRs): The TPM uses Platform Control Registers (PCRs) to hash and verify each component of the boot process (firmware, kernel, initrd, command line). If the hashes don't match (indicating modification), the TPM will not "unseal" the encryption key (demonstration provided).
47:37 Handling PCR Changes: For frequently changing components (like the kernel/initrd), a "signed PCR policy" can be used where a Unified Kernel Image (UKI) is signed by a key bound to the TPM, allowing automatic re-signing on updates.
Unmeasured Components: If certain boot components (e.g., kernel command line, initrd) are not measured by PCRs, an attacker can modify them to gain a root shell and decrypt the disk.
54:44 Cold Boot Attacks with TPM: If a system automatically decrypts using a TPM without pre-boot authentication, attackers have an unlimited number of cold boot attempts.
55:15 TPM Sniffing: Attackers can sniff the communication between the CPU and TPM to intercept the encryption key, especially if pre-boot authentication is not enabled. Tools like a Raspberry Pi Pico can facilitate this without soldering.
56:14 TPM Sniffing Mitigations: Firmware TPMs (embedded in the CPU) and parameter encryption (encrypting CPU-TPM traffic).
56:36 Windows BitLocker's "Broken State": BitLocker often decrypts automatically without a PIN, lacks perimeter encryption, and is vulnerable to TPM sniffing (reportedly bypassable in minutes on major enterprise laptops). Recovery keys are often stored online. While pre-boot authentication could fix these issues, it's unnecessarily complex for average users to enable.
57:56 Conclusion on Encryption: FDE still works as a defense mechanism, with forensics reports sometimes stating inability to bypass it. However, smartphone FDE has significant flaws, Windows BitLocker is problematic without manual hardening, and Secure Boot/TPM are powerful when combined effectively.
58:36 Non-Technical Solutions by Law Enforcement: When technical bypasses fail, police resort to non-technical methods, including deception (e.g., posing as delivery drivers to gain access to unlocked devices), forcing biometric unlocks (confirmed legal in Germany), and psychological pressure or lies to coerce individuals into providing PINs voluntarily.