nerdexam
GIAC

GPEN · Question #283

You work as a professional Ethical Hacker. You are assigned a project to perform blackhat mechanic. You claim that someone from the office called you saying that there is some fault in the…

The correct answer is A. Encrypting disk partitions B. Using password protected hard drives. Booting from a live CD bypasses all OS-level access controls, so only hardware-enforced disk encryption and drive passwords can prevent an attacker from reading or modifying the filesystem.

Reporting & Remediation

Question

You work as a professional Ethical Hacker. You are assigned a project to perform blackhat mechanic. You claim that someone from the office called you saying that there is some fault in the air-conditioner of the server room. After some inquiries/arguments, the Security Administrator allows you to repair the air-conditioner of the server room. When you get into the room, you found the server is Linux-based. You press the reboot button of the server after inserting knoppix Live CD in the CD drive of the server. Now, the server promptly boots backup into Knoppix. You mount the root partition of the server after replacing the root password in the /etc/shadow file with a known password hash and salt. Further, you copy the netcat tool on the server and install its startup files to create a reverse tunnel and move a shell to a remote server whenever the server is restarted. You simply restart the server, pull out the Knoppix Live CD from the server, and inform that the air-conditioner is working properly. After completing this attack process, you create a security auditing report in which you mention various threats such as social engineering threat, boot from Live CD, etc. and suggest the countermeasures to stop booting from the external media and retrieving sensitive data. Which of the following steps have you suggested to stop booting from the external media and retrieving sensitive data with regard to the above scenario? Each correct answer represents a complete solution. Choose two.

Options

  • AEncrypting disk partitions
  • BUsing password protected hard drives
  • CPlacing BIOS password
  • DSetting only the root level access for sensitive data

How the community answered

(26 responses)
  • A
    81% (21)
  • C
    8% (2)
  • D
    12% (3)

Why each option

Booting from a live CD bypasses all OS-level access controls, so only hardware-enforced disk encryption and drive passwords can prevent an attacker from reading or modifying the filesystem.

AEncrypting disk partitionsCorrect

Full-disk encryption such as LUKS on Linux or BitLocker on Windows renders the partition unreadable and unmodifiable without the decryption key, even when the attacker boots from external media and mounts the drive directly.

BUsing password protected hard drivesCorrect

Password-protected hard drives enforce authentication at the hardware level, preventing any system - including a live CD boot - from accessing or mounting the drive without valid credentials.

CPlacing BIOS password

A BIOS password can be bypassed by physically removing or shorting the CMOS battery to reset firmware settings, and it does not protect data on the disk once circumvented.

DSetting only the root level access for sensitive data

Root-level OS access controls are entirely irrelevant when an attacker boots from an external live CD, since they bypass the installed OS and access the raw filesystem directly.

Concept tested: Physical access attack countermeasures using disk encryption

Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/

Topics

#physical security#disk encryption#live CD attack#BIOS password

Community Discussion

No community discussion yet for this question.

Full GPEN Practice