Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it necessary to have hard drive and bios passwords if you also have full disk encryption, or maybe at least the hard drive password is unnecessary because there would be two passwords protecting essentially the same thing?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

BIOS passwords are fairly pointless as soon as someone has undisturbed physical access to your machine. Most mainboards have a switch or a jumper that you can use to reset the CMOS; if that fails, you'll most likely be successful by removing the CMOS battery and waiting a few seconds - usually the BIOS password is then either cleared or reset to a (google-known) default. If this also fails, the easy solution is to remove the harddisk from the original system and mount it on another machine.

The only value of a BIOS password is to prevent (legit) users from fiddling with BIOS settings in a supervised situation (e.g. public computers: opening up one of these and removing the HDD is going to be noticed, but one can usually get away with getting the computer to reboot and then entering the BIOS). In other words: A BIOS password only protects if physical access to the machine is limited.

The hard drive password (that is, the passphrase you use to unlock the full-disk encryption) is necessary, and if you have set it up properly, it doesn't matter where you mount the disk, you will always need the passphrase to make sense of the data (that, or brute-force the encryption). Even with unlimited physical access to the entire machine, full-disk encryption needs to be broken in order to get to the data.

share|improve this answer
    
"you'll most likely be successful by removing the CMOS battery and waiting a few seconds" - which modern motherboards still have BIOS batteries? –  DanBeale Oct 16 '11 at 22:00
    
some have a simply jumper that does exactly the same of removing the battery –  woliveirajr Oct 17 '11 at 17:12
1  
@DanBeale: I've seen enough of those. –  tdammers Oct 17 '11 at 21:29
1  
@DanBeale Yours too has a battery of some sort, otherwise the clock would have to be re-adjusted at every boot. –  Camilo Martin Mar 20 '12 at 5:24
    
@CamiloMartin - here's one board where battery is optional if cord is left connected (motherboards.org/files/manuals/7/ax6bc-ol-e.pdf) if the cord is disconnected you lose the RTC info but everything else is stored to EEROM. Here's an article which mentions capacitors used instead of batteries. (tomshardware.com/reviews/…) Here's a laptop that doesn't have motherboard battery (uses main battery or a capacitor) (support.apple.com/kb/TA25911?viewlocale=en_US). –  DanBeale Mar 27 '12 at 11:53
add comment

I mostly agree with @tdammers, however BIOS passwords are actually very useful for the typical builds you get in large corporates. An attacker who has physical access in this sort of scenario will not be able to just disable it by removing the CMOS battery - as to reset them actually requires the corporate reset code.

This is quite an important control - for some high value attacks, the attacker would need to gain access to the device, steal data or implement some kind of exploit, then hide their tracks and leave the machine in a state where the intrusion is not discovered. With the BIOS password, an EVIL MAID attack is much harder to carry out.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.