0

Suppose an attacker gained physical access to a device (a smartphone, for example). Would be be harder for the attacker to perform malicious actions on the phone when the phone is shut down?

I’m asking the question because I’m aware of several points:

  1. Physically changing some kinds of devices is hard for attackers with average ability. For example, while it would be easy to attach a hardware keylogger to a keyboard connected to a large desktop computer, doing so on a phone without being discovered by the user is considerably harder (e.g. weight change, space constraints, abnormal wear and tear). Because of these, attackers may look for other attack vectors.

  2. For a running system, it’s hard to restore the state of the system after altering it physically. For example, manipulating the system’s RAM may lead to a shutdown. If the admins are aware of such an abnormal behaviour next morning, they may perform hardware checks before any hardware keylogger logs their admin passwords. For a phone, the lock screen may change after rebooting (e.g. fingerprint unlock disabled, unread notifications disappeared).

  3. For a running system it would be easier to run code on it, for example, inserting removable devices or exploiting vulnerabilities in the lock screen. For a system with above-average security, attackers may not be able to run code easily (e.g. locked servers, checking for kernel signature during booting etc).

I would appreciate it if you notice some other points/mitigations.

  • I think your question is interesting to think about, but at the same time, the scope is very broad. For example, you are thinking about hardware modifications and if they might be detected by the legitimate user or not. This would be applicable to a specific situation, where the attacker would gain temporary physical access to the system in questions but would return it back afterwards. – TorstenS Aug 27 '18 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.