Raspberry Pi OS with LUKS

Short notes with setup for working remote LUKS decrypt. Unofrtunately after cryptroot-unlock success it shutdowns the system :) Maybe I will try again when will find some time.

1. Burn Rasberry Pi OS Lite image

2. Create additional partition for encrypted root partition.

3. Update and restart:

apt-get update && apt-get upgrade
sudo shutdown -r now

4. Install deps:

apt-get install busybox cryptsetup dropbear-initramfs lvm2

5. Prepare partition:

cryptsetup -v -y --cipher aes-xts-plain64 --key-size 256 luksFormat <newroot>
cryptsetup -v luksOpen <newroot> sdcard
mkfs.ext4 /dev/mapper/sdcard
cryptsetup luksClose /dev/mapper/sdcard

6. Configure partition in the system: check :

blkid | grep crypto_LUKS

open /etc/crypttab and add:

sdcard    <newroot>    none    luks,initramfs

open /etc/fstab and replace original root partition with:

/dev/mapper/sdcard      /       ext4    defaults        0       1

open /boot/cmdline.txt and replace existing partition config with:

root=/dev/mapper/sdcard cryptdevice=<newroot>:sdcard

also add at the end of the same file dhcp configuration:

ip=:::::eth0:dhcp

7. Configure early decryption:

echo 'DROPBEAR_OPTIONS="-RFEsjk -c /bin/cryptroot-unlock"' > /etc/dropbear-initramfs/config
echo "CRYPTSETUP=y" >> /etc/cryptsetup-initramfs/conf-hook

8. Fix issue with short timeout for decryption:

sed -i 's/^TIMEOUT=.*/TIMEOUT=100/g' /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock

9. Configure early remote access over SSH:

touch /boot/ssh
echo '<your_public_ssh_key>' > /etc/dropbear-initramfs/authorized_keys

10. Copy files from original root partition to the new encrypted partition. 11. Generate initramfs:

sudo mkinitramfs -o /boot/initramfs.gz
echo "initramfs initramfs.gz" >> /boot/config.txt

12. Reboot and try to connect remotely. Configs for ssh:

Host pi
    HostName <ip>
    User user
    PreferredAuthentications password

Host pi-enable
    HostName <ip>
    User root
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null
    IdentityFile ~/.ssh/<your_public_ssh_key>

Links:

https://github.com/ViRb3/pi-encrypted-boot-ssh

https://www.paxswill.com/encrypted-raspberry-pi/

https://www.kali.org/docs/arm/raspberry-pi-with-luks-full-disk-encryption/

https://www.arminpech.de/2019/12/23/debian-unlock-luks-root-partition-remotely-by-ssh-using-dropbear/

SeniorITy Code powered by Sii - Embedded

Two weeks ago I participated in meeting where shortly were preseted different security aspects of the embedded systems.

First talk was a introducion into C++11 for beginners. Next two were about safety and security of embeddes systems. Part about safety was focused on developing standards for increase of a quality of the final system (eg. restrictions in memory management).

Last part was the most interesting in my opinion. Many methods of systems analysis were metioned - including copying of the architecture techniques. It is a real problem when it is that simple to reconstruct the net list from photos of a circuit using tools like degate. To watch how the device is working there are methods called side channel attacks. Attacker can observe properties such as power usage, processing time, temperature or electro magnetic emissions to get knowledge about computations inside a chip. Other kind of attacks are state modifications. Using laser beam it is possible to change memory registers (but not single bit) which can be used to introduce changes in the code execution. Other methods are: overheating what leads to skiping instructions in some processors or changing voltage level to change signal interpretation (high/low state).

Links:
Sri Parameswaran, Tilman Wolf - Embedded systems security—an overview

0patch

I've just read about very interesting product - 0patch. Occasionaly, we got to know that some companies didn't fixed the bug which is causing serious vulnerability. When it becomes public sometimes we have to wait months for an official patch and 0patch want to provide own unofficial fixes.
The idea is simple: they prepare small patches which are applied by 0patch agent in the runtime. That solution uses technique called function hooking to modify existing code. They also shared manual for developers which shows how to prepare own patches.

Links:
0patch blog