943
submitted 1 year ago by leraje to c/privacy@lemmy.ml

Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!

you are viewing a single comment's thread
view the rest of the comments
[-] csolisr@communities.azkware.net 31 points 1 year ago

From what I read in the article, there is still one part of the boot sequence that does require some sort of storage: the part where the bootloader fetches the network boot image and verifies it against the checksum signature. But I think that can be performed by booting from a pendrive and then removing it. The problem will come if law enforcement gets a hold of said pendrive...

[-] Deconceptualist@lemm.ee 73 points 1 year ago

Why would that be a problem? A boot image should only contain the commands to get the main system started after POST. It shouldn't contain any kind of logs, traffic data, or user data. In fact it should be read-only.

[-] ikidd@lemmy.world 25 points 1 year ago

PXE boot will TFTP the boot image into RAM and carry on from there. You shouldn't need any storage on your device.

[-] csolisr@communities.azkware.net 2 points 1 year ago

I'm aware of PXE, but in order to do so you need either of:

  • the boot image supplying server being in the same intranet as the rest of the other servers, or
  • some sort of method to point the diskless server to the correct external IP address to listen to

Since the first mode is probably too unsafe, that leaves us with the second mode. Either the operator memorizes a specific IP address and types it into the BIOS each time the server is rebooted, or the IP address (and possibly the checksum of the image) are stored in a single-use pendrive that the operator carries. I wonder which of these two methods is used in this case.

[-] Kangie@lemmy.srcfiles.zip 4 points 1 year ago

PXE is automagic being basically kind of hacky extension to DHCP stuff.

If PXE is enabled the machine will automatically find it via a DHCP relay on the network.

the boot image supplying server being in the same intranet as the rest of the other servers ... Since the first mode is probably too unsafe, that leaves us with the second mode.

Why do you think that's unsafe?

[-] sixCats@lemmy.dbzer0.com 3 points 1 year ago

I’ve never done this, but I believe server network cards can be configured for PXE automatically so

Bios -> network card -> PXE over network

So the storage is in the bios config, and then I guess the network card has its own kind of bios?

[-] csolisr@communities.azkware.net 1 points 1 year ago

So there is still one single damning piece of information stored in the servers after all - the IP address to fetch the PXE boot image from. But hey, if Mullvad finds a way to strip even that out of the servers, that'd be great

[-] sixCats@lemmy.dbzer0.com 2 points 1 year ago
[-] csolisr@communities.azkware.net 1 points 1 year ago

Because by knowing which IP is the boot image stored from, law enforcement can locate the source of the unencrypted image, thus making the scheme lose its privacy. The only way to bypass the issue is by manually configuring the IP after every reboot and keeping it a secret.

[-] sixCats@lemmy.dbzer0.com 2 points 1 year ago

Why does being able to access the unencrypted image pose such a problem?

[-] csolisr@communities.azkware.net 2 points 1 year ago

Because by doing so, law enforcement can manipulate the image from the source by:

  • Intercepting the payload and modifying the operative system to send data to law enforcement
  • Pose as the origin of the original payload, and send the tainted operative system to other devices when they reboot

Unless, of course, the BIOS stores the checksum of the untainted image. (Which adds its own can of worms, because that would make legitimate image upgrades require writing the new proper checksum on each server)

[-] mub@lemmy.ml 14 points 1 year ago

Boot Drive could be immutable and not contain any form of log?

[-] ultratiem@lemmy.ca 10 points 1 year ago

Destroy the drive. That’s what Apple does and how they get around the whole “we need a backdoor” problem. When no one can access the server, no more problems.

[-] csolisr@communities.azkware.net 1 points 1 year ago

Something tells me that they have a stack of single-use drives so that each time a server needs to reboot for some reason, they write a boot loader in one from their central headquarters, walk back to the server room, use the device to boot the server, and finally hammer the everliving bejeezus out of the thumb drive juuuuust in case. Hopefully they don't have to reboot that often!

this post was submitted on 20 Sep 2023
943 points (100.0% liked)

Privacy

32091 readers
409 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS