GPEN · Question #340
You work as a professional Ethical Hacker. You are assigned a project to perform blackhat mechanic. You claim that someone from the office called you saying that there is some fault in the air-conditi
The correct answer is B. Encrypting disk partitions. D. Using password protected hard drives.. Booting a server from a live CD bypasses OS-level access controls entirely, so disk encryption and hardware-level drive password protection are the effective countermeasures against unauthorized data access via physical media.
Question
You work as a professional Ethical Hacker. You are assigned a project to perform blackhat mechanic. You claim that someone from the office called you saying that there is some fault in the air-conditioner of the server room. After some inquiries/arguments, the Security Administrator allows you to repair the air-conditioner of the server room. When you get into the room, you found the server is Linux-based. You press the reboot button of the server after inserting knoppix Live CD in the CD drive of the server. Now, the server promptly boots backup into Knoppix. You mount the root partition of the server after replacing the root password in the /etc/shadow file with a known password hash and salt. Further, you copy the netcat tool on the server and install its startup files to create a reverse tunnel and move a shell to a remote server whenever the server is restarted. You simply restart the server, pull out the Knoppix Live CD from the server, and inform that the air-conditioner is working properly. After completing this attack process, you create a security auditing report in which you mention various threats such as social engineering threat, boot from Live CD, etc. and suggest the countermeasures to stop booting from the external media and retrieving sensitive data. Which of the following steps have you suggested to stop booting from the external media and retrieving sensitive data with regard to the above scenario? Each correct answer represents a complete solution. Choose two.
Options
- ASetting only the root level access for sensitive data.
- BEncrypting disk partitions.
- CPlacing BIOS password.
- DUsing password protected hard drives.
How the community answered
(23 responses)- A9% (2)
- B74% (17)
- C17% (4)
Why each option
Booting a server from a live CD bypasses OS-level access controls entirely, so disk encryption and hardware-level drive password protection are the effective countermeasures against unauthorized data access via physical media.
Restricting root-level access controls permissions within a running OS session; once the attacker boots from an external live CD, the original OS is bypassed entirely and root restrictions have no effect on the mounted filesystem.
Full disk or partition encryption ensures that even after mounting partitions from a live CD environment, all data including /etc/shadow remains ciphertext and is unreadable without the decryption key, directly neutralizing the described attack vector.
A BIOS password restricts changes to boot order settings, but it does not protect data on the hard drive if the attacker physically removes the drive and connects it to another machine, making it insufficient as a sole data-protection measure.
Password-protected hard drives use ATA security features to lock drive access at the hardware/firmware level, preventing the drive from being read or written by any OS - including a live CD - without first supplying the correct drive password.
Concept tested: Physical server security - live CD boot attack countermeasures
Source: https://csrc.nist.gov/publications/detail/sp/800-111/final
Topics
Community Discussion
No community discussion yet for this question.