|author||Jacob Appelbaum <email@example.com>||2011-04-30 01:35:06 -0700|
|committer||Jacob Appelbaum <firstname.lastname@example.org>||2011-04-30 01:35:06 -0700|
1 files changed, 19 insertions, 1 deletions
@@ -2,5 +2,23 @@
S.M.A.R.T. Monster Only Notices Surreptitious Tampering Events Retroactively
-An anti-forensic reboot, disk access, and basic tamper detector
+"An anti-forensic reboot, disk access, and basic tamper detector"
+This set of scripts is written with the express purpose of detecting changes in
+the bootable file system, with the unencrypted block device used for booting,
+with S.M.A.R.T. data provided by your drives, and other interesting data
+This software assumes that your /boot is unencrypted and that everything else
+is encrypted with full disk encryption; it also assumes that your hard disk is
+a spinning platter with S.M.A.R.T. support - this may also function with SSD
+storage devices but is as of yet untested.
+We also assume that you layer your file system encryption with something like
+eCryptFS for use after the full disk encryption has been unlocked. Anything
+less will allow an attacker to simply log your main encryption key and leak it
+through a covert channel, such as attempting to join a wireless network with
+your key as the ESSID. Detection of such an event after the fact may be too
+This is of course entirely imperfect and still worth exploring.