# Security 'Oversight' Lets Attackers With Physical Access, Access Some Encrypted Linux Systems **URL:** https://discuss.privacyguides.net/t/security-oversight-lets-attackers-with-physical-access-access-some-encrypted-linux-systems/28940 **Category:** News **Tags:** software, article **Created:** 2025-07-06T20:50:11Z **Posts:** 8 ## Post 1 by @HackOrSwim — 2025-07-06T20:50:11Z > **[New Linux Security Flaw Uses Initramfs to Inject Malware](https://www.omgubuntu.co.uk/2025/07/ubuntu-security-initramfs-bypass-encryption)** > > A newly found security flaw in Ubuntu could allow attackers with physical access to bypass full disk encryption. Learn how the attack works. > A [report published by _ERN_W](https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/) demonstrates the exploit on Ubuntu 25.04 and Fedora 42, though not all Linux distributions are affected, such as OpenSUSE Tumbleweed. > > So how does it work? > > Attackers with physical access to a Linux system can access a debug shell simply by entering the wrong decryption password several times in a row. On Ubuntu, they hit esc at the password prompt, punch in a few key combos, and bam: debug shell appears. > > It’s through this low-level debug shell that attackers can compromise an encrypted system. > > They can mount a USB drive with tools that let them modify the initramfs (_Initial RAM Filesystem_ – a temporary system run during boot to prep the main OS) to inject malicious code, and then repack it – without tripping any security flags. ERNW report: [Insecure Boot: Injecting initramfs from a debug shell – Insinuator.net](https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/) The report also states that while this debug mode in Fedora doesn’t have the USB modules necessary for the attack, the GRUB rescue initramfs does have them. Personal opinion: Evil maid attack that could maybe be resolved with a [self-signed UKI](https://wiki.archlinux.org/title/Unified_kernel_image), although that may be complicated to setup for some people. It’s also first time I’m hearing about this particular vector, but it may already have been a known issue. --- ## Post 2 by @anon63378630 — 2025-07-06T21:30:59Z blogspam over a “security vulnerability” --- ## Post 3 by @HackOrSwim — 2025-07-06T21:55:32Z Makes sense. Thanks for your input. --- ## Post 4 by @anon73250778 — 2025-07-06T23:32:03Z Physical access requirement for the exploit… it’s fine… --- ## Post 5 by @anon65804091 — 2025-07-07T00:18:56Z Physical access exploits are the scariest! Ubuntu is vulnerable to several of these: > [@](#): > > :hushed_face: **CVE-2000-1531 Detail** > > ### Description > > A vulnerability in all versions of cryptsetup allows an attacker with physical access to a system encrypted with LUKS to install a keylogger in the keyboard, potentially resulting in confidential information leakage. > [@](#): > > :fearful: **CVE-1234-5678 Detail** > > ### Description > > An attacker with physical access to any computer can install a hidden camera in view of the monitor, potentially resulting in confidential information leakage. > [@](#): > > :scream: **CVE-1015-1337 Detail** > > ### Description > > An unauthenticated attacker with physical access to any computer can exploit a denial-of-service vulnerability by sending a specifically crafted sledgehammer to the hard drive, potentially causing the system to crash or become unresponsive. --- ## Post 6 by @anon73250778 — 2025-07-07T01:19:12Z > [@anon65804091](#): > > Physical access exploits are the scariest! Sure… they can try to get to me in a remote rural island. You guys get next day Amazon delivery. I am so far away that the fastest I can get from offshore US… is 2 weeks… 10 days if I pay for the “premium shipping”. Theft for resale/fencing will always be likeliest scenario in most places. Dont be the low hanging fruit with no FDE. --- ## Post 7 by @anon65804091 — 2025-07-07T01:33:20Z > [@anon73250778](#): > > Theft for resale/fencing will always be likeliest scenario in most places. Dont be the low hanging fruit with no FDE. Is that really enough though? Maybe the teenage hooligan breaking into your house is going to pull out a can of liquid nitrogen and [1,195$ Passware Key Recovery Forensics kit](https://www.passware.com/kit-forensic/) to mount a cold boot attack. I saw a group of kids tampering with my power lines the other day, I think they were trying to [extract my AES encryption keys by measuring power consumption](https://finalcrypt.org/docs/tempest_attacks_against_aes.pdf), but for some reason they ran off with the cables. Who knows with burglars these days. --- ## Post 8 by @anon73250778 — 2025-07-07T02:25:30Z > [@anon65804091](#): > > I saw a group of kids tampering with my power lines the other day, Are you really assuming people are very smart and very educated with highly technical skills and not junkies looking for an easy cash out with the copper in your power lines? I mean sure if you are a journalist/politician/activist with a real high threat model. But most people are that and hackers able to do extract my AES encryption keys by measuring power consumption, including the noise of all appliances indoors? Dont the WiFis of the world also use AES?