8

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic knowledge of encryption and I can work with hidden Veracrypt volumes, but it doesn't protect me when attacker has physical access.

  • Not to say you shouldn't protect yourself from them, but physical "hardware present" attacks are relatively rare. Make sure you don't forget to protect yourself more common remote attacks. Consider your email provider, messaging service, cloud storage service, etc. Beware of phishing or spearphishing attacks. Beware of shoulder surfers capturing your screen with a camera. Limit the software installed on your devices to the absolute minimum. – Owen Apr 7 at 0:05
  • 1
    Well the thing is that a house raid and confiscation of my hardware for an undetermined amount of time is more likely than a remote attack. – Robby Apr 8 at 21:42
  • Depending on how much you trust the brand, Purism's Librem 15 might be worth a look. You can put Qubes on it pretty easily, which helps protect you from remote attack and really easily supports a ton of features to protect against evil maids. If you buy their hardware token too, they claim it'll tell you at boot whether or not any part of your OS has been tampered with -- the security looks legitemate, if their description is accurate. I'd write up a full answer but I'm not sure "buy this laptop" is really a good one... – Nic Hartley Jul 10 at 1:41
  • @NicHartley Librem is really nice, but they don't mitigate rowhammer attacks and, unfortunately, don't consider it an issue due to their misunderstanding of the BIOS "rowhammer mitigation" feature which only doubles refresh rate. It would be necessary to use it with something like B-CATT which adds vulnerable address ranges to the e820 blacklist. Other than that, they're really good, especially with their experimental HEADS measured boot bootloader. – forest Jul 12 at 5:43
10

Tails is exactly what you want, being designed with activists in mind! It is a live Linux-based operating system that can run from a DVD or USB stick which is amnesic, meaning that any data that isn't explicitly saved to storage will vanish on reboot, including settings, metadata, and other information. Every time it boots up, it boots up fresh as if you have never used it before. Additionally, it forces all network connections through Tor, using a firewall to protect even from a compromised web browser.

Tails includes a variety of useful tools for document processing such as video and audio editors, text and document processors (generally compatible with the Microsoft Office suite), and a myriad of tools for cryptography, such as email clients supporting GnuPG encryption, chat clients supporting a wide variety of protocols (IRC, XMPP, AIM, etc) with chat encryption using OTR, and disk encryption utilities. It also contains Tor Browser, a browser designed for anonymity with use of the Tor anonymity network.

Basic evil maid attacks are prevented by keeping the Tails DVD or USB stick on your person, or downloading and verifying a fresh one if your primary copy was out of your sight for too long and may have been compromised. However, it is effectively impossible to protect from a sophisticated attacker who has prolonged access to your computer and is able to insert hardware backdoors.

Tails does

  • Prevent someone with your powered off computer from learning what was done on it.

  • Protect the content of your internet communications from a Wi-Fi or ISP-level attacker.

  • Allow you to visit websites without the websites knowing your location (anonymity).

Tails does not

  • Hide the fact that you are using Tails from an attacker on the network or a local adversary.

  • Protect your computer from prolonged physical access before or while it is on.

  • Prevent you from making OPSEC mistakes, such as accidentally publishing your identity.

For more detailed information on Tails' threat model, consult the design document.

Disclaimer: While not a core developer, I contribute code to Tails and as such could be considered associated with it.

3

Whole disk encryption, UEFI secure boot, with TPM hardware.

This won't stop an embedded key logger from capturing the credentials, but it's about as secure as you can get.

If you want to go even further, link the decryption to a Yubikey (or equivalent) in challenge-response mode and even a key logger won't work.

Just remember that Rubber Hose Cryptography doesn't have a technical solution.

  • UEFI secure boot is extremely limited. To protect against hardware attacks, the minimum would be SRTM-based measured boot using a TPM, which is harder to achieve with minimal computer knowledge. – forest Apr 5 at 23:44
2

This is an important conversation, as the same thing needs to be considered with politicians and other possible higher-profile targets. While something like Tails (mentioned already) is great for your physical machine, it is also important to consider the email and online platforms that you use as they are often the target of phishing attacks. Not sure what the rules on here is about specific product endorsements, but if you are using a Gmail account then I would look into Google's "Advanced Protection" account. It takes your gmail account and forces you to do the following:

  • Password requirement is stronger
  • Requires a UFA key (like the Yubikey or Google's new Titain USB Key)
  • Restricts apps that can connect to the account
  • Strict rules about the devices that can log in
  • Etc, etc...

WIRED ran an article on this when it was first released and this quote really stuck out to me: "If John Podesta had been able to turn this on sometime last year, the world might be a very different place."

Even if you don't use Google, then make sure that you are using 2FA everywhere you can (UFA keys are great too if supported), and consider using a password manager to generate secure passwords and that you are not reusing those passwords anywhere else.

1

Protecting against Evil is very hard, especially if you are the target. I'll write some complementary solutions to user10216038's answer.

Use a Live CD so that your operating system cannot be modified. You can prepare yourself with the necessary software; Disk encryption, etc. (see user10216038's answer.)

There is also a Tempest attacks where the adversary may steal your information even giving any effect on your laptop/PC. To secure against Tempest attack you have to buy specialized hardware and power filters. In some cases, a secured room may be required.

  • Look into "Anti-Evil Maid" by the Qubes OS author. There are similar solutions too, like STARK/MARK (by the same guys who made the TRESOR kernel patch) and Heads (designed as part of a collaboration with the Purim Librem laptop guys). Any of those can efficiently mitigate evil maid attacks. – forest Apr 15 at 11:02
0

As a political activist whose computer may be of interest to local, unethical state operators, I suggest you really want something sort of deniable encryption.

Currently there is not a great deal of choice around implementations - but product recommendations are off-topic here. Googling the magic words "Deniable encryption" should take you to some potential sources, but do beware that the bad guys may also be watching your internet searches.

0

Make sure you already do routine preventive measures you have access to today, and its free. Again, protection methods reduce the speed of penetration and requires more skill level of the perpetrator so it deters 'evil maids' from accessing your unattended laptop to try and plant malware.

Note, how these features prevent access varies by make and model. Many 'high end' laptops have ways to bypass UEFI/BIOS locks, some easier than others. However, if they bypassed locks they also erase your former passwords, you know you've been penetrated. If you have UEFI with TPM and its required by your OS it may erase all Secure Boot keys as well as the ownership, and may stop, make it hard or alter the boot sequence, again showing something is not right.

Have you:

Set a UEFI or BIOS based password for both ADMIN and USER? This prevents the operating system from loading so your device is stopped at the firmware level. This is more secure in general in UEFI setting with TPM.

Disabled boot from anywhere but the internal HD? This disables USB or any external ports, as well network boots.

Set a different hard drive password, if available? This prevents the hard drive from starting up, and has firmware independent of the UEFI of your laptop, in case its bypass able, see first item above. There maybe software to unlock the drive, but often it can be done by wiping it clean, or requires laptop disassembly, but if they managed to unlock it in situ, loss of password would betray its been penetrated.

Some manufacturers may have a hidden UEFI/BIOS reset to factory sequence built into their firmware accessible via the keyboard, such as Dell, the firmware is stored in a recovery partition on the HD. Access can be halted by setting a HD password, if available, as this prevents the HD from booting and is independent of the manufacturer's firmware beyond the UEFI. Regardless, with passwords reset it again reveals to you, something is not right.

Never sleep your computer, power down completely, versus cold boot, evil maid issues

Use Veracrypt as whole disk encrypt mode, and use the hidden operating system mode, which creates a decoy environment. Do the same for containers. Alternatively, use Windows bitlocker if on Windows, which is better is best left for another question.

Don't save sensitive files on your PC but on an encrypted card you take with you, if net access is variable quality or untrusted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.