Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but distracted by conversation and unable to keep an eye on the laptop. The attacker would not be able to open the case. Does the answer depend on the OS?
As an aside, it's getting hard to find a decent laptop which doesn't charge through USB-C, so I cannot block all the ports. Any solutions for this?
Because USB is plug and play, there are many opportunities for evil maid attacks with unrestricted port access. The article here shows how to use and human interface device to bypass the Windows lock screen: https://room362.com/post/2016/snagging-creds-from-locked-machines/
To prevent a human interface device from automatically running commands on a computer, the OS would need to be configured to ignore the USB ports. Autorunning and automounting drives should also probably be disabled, but these are usually problematic only after the computer has been unlocked. The exact method of disabling USB port access is OS dependent. Of course, if there is a bug in the OS that the attacker knows about, they may be able to circumvent the lock screen anyway. However, in the situation you presented, the biggest threat is rogue human interface devices. It only takes a few seconds for a plugged in drive to cause damage if the OS does not ignore it.
Some BIOSes also allow disabling USB ports, but I'm pretty sure that human interface devices can still connect, since it could be catastrophic to block all external control devices so early in the boot sequence.
EDIT: I had missed that the original question was specificaly related to when the laptop was locked, but still powered on. While what is possible would heavily depend on any vulnerability in the OS, the fact that the computer is locked makes an attack more difficult, but still possible.
An attacker would need knowledge of specific flaws in the OS allowing transfer or storage of information. As the USB-port is powered when the screen is locked this is a possible attack vector.
It should also be noted that my original answer is still valid if you were to unlock the computer without noticing the device, as it would now be plugged in to an unlocked machine.
Original answer:
One of the simplest attacks for this scenario would probably be to insert a tiny device into the USB-port and hope you don't notice it. The device could be anything from a dummy keyboard programmed to input specific presses at a certain time, maybe to distract you, or hope to change some information. It could also have a transmitter, and exploit some vulnerability in the OS to leak information.
Exactly how likely this is to succeed would depend on whether you notice the device, and what exactly the device exploits.
