I have HDD with GPT, 1 MiB BIOS boot partition and LUKS encrypted volume group with data. When I boot the computer, GRUB asks for passphrase.
However, I want to run some untrusted application which MAY have full HDD access. Could it insert some malware into boot sector to record the passphrase somewhere and then steal it when possible?
If yes, is it possible to protect against it?