What are the best steps to take to secure a LINUX PC from physical attack? Evil Maid, Boot Sector Malware?

Question

What would be the best security practice to protect a device from physical attack? For instance an Evil Maid or boot sector malware?

For this question we are going to go with a UEFI boot debian linux OS laptop. Obviously, encrypting the OS is going to be my first step. Next, I assume something like Secure Boot & TPM.

I am kind of confused on two. Locking down USB ports so they are unable to be used. I can do that in in bios settings correct? I don't know if it is possible but can you completely copy all boot files to a read-only USB and boot from that read-only USB every time you boot the OS so you know that it is safe? In another question someone stated that someone could come in and modify the OS and leave so when you come back and decrypt it, it can steal your password. How would this be possible if your USB ports are blocked and everything is signed/secure with you?

What would be the steps one would take to secure against this type of attack as much as possible and any attack vectors that could possibly still be exploited regardless of the steps that are taken?

Answer 1

There are multiple steps that can help to mitigate evil maid attacks. Some are technical and others are physical.

1. The device can be manipulated when it is shipped to you. There are manufacturers who put glitter nail polish on each screw and provide you with a picture of each screw. Each pattern of glitter is unique and you can detect manipulation. There are also more expensive temper evident technologies.
2. The device can be manipulated in your office. To prevent tempering you can lock your device in a safe place or a temper resistant safe. You can additionally install surveillance cameras and or proximity sensors. Some computers have sensors, that detect the opening of the device. This will help to prevent or detect physical attacks.
3. Check the seals and input/output devices of your computer before you start working. This will help to detect manipulations.
4. Some admins use glue or other material to physically seal their USB ports. You can also disable them in the UEFI on most devices. This will prevent Bad USB attacks.
5. Set a strong password for the UEFI and also to boot your device. This makes it harder for attackers to access your device or boot from another disk/storage/network.
6. As you mentioned, you should encrypt the OS to prevent data leakage or tempering with the OS.
7. Enable Secure Boot and the TPM. Ensure that only signed code is loaded at startup. This should prevent many viruses and modifications of your systems, that try to manipulate the UEFI or the bootloader to run outside of your OS.
8. Disable all features in the UEFI and OS, that are not used. This reduces the attack surface.
9. Configure your system to only execute signed code and signed kernel modules, if possible.
10. Use tools like chkroot and tripwire to check for any changes in your system. You can store the tripwire baseline on a read only device like a CD or a SD card with RW switch, that you keep with you.
11. Make sure you shut down your device after use and not only suspend it. Running computers can be attacked via a cold boot attack.
12. Newer CPUs have memory encryption capabilities and other features, that can help to mitigate advanced attacks. So try to pick a device with modern security features.

Answer 2

Firstly, encrypt your drives and shut down completely your computer when not in use. That's not to protect against evil maids, but against loss of confidentiality if your computer gets stolen. Secondly, always keep your computer in direct view (not inside a bag in a storage overhead when traveling by train or plane, for example). When you cannot, keep it under lock inside a temper resistant safe that will show forced entry, in a place under alarm.

That might not be the answer you are looking for, but that would be the first answer you would get from a counter intelligence agency. On top of those recommendation, you can then add other protections like Secure Boot.