Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!

Or if someone tries (evil maid) to modify the /boot then he has to power off my machine, but later I will notice that! Are there any backdoors of this concept?

share|improve this question
up vote 2 down vote accepted

They don't have to power off your machine to disconnect (not necessarily remove) the hard disk from your notebook and reconnect it to a different machine, modify the /boot partition, and then reconnect it to your notebook. As long as the notebook is sleeping, it won't even notice. On your next boot, you could be compromised. There are methods to remove SDRAM and read its contents. Of course these take a moderately sophisticated attacker.

share|improve this answer

I see no obvious flaw in your reasoning. However, this scenario requires you to always have your notebook near power supply. An attack as you stated might be carried out anyways with you thinking it powered down because the battery was low.

Considering the hard disk is down, an attacker could modify the "Please enter password" part in your boot-loader to log passwords. This would, of course, never trigger if you always kept your notebook switched on.

Also, leaving your machine unattended and not suspended might pose other security risks as well. A common scenario would be Firewire which as DMA (direct memory access). Other possibilities would be faulty handlers of other external devices like USB (autostart etc.).

I'm curious if anyone has some suggestions on lower-level attack techniques that might require more knowledge in electrical engineering than I can spare right now ;) Could one disassemble and tap something with the RAM still powered on maybe?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.