I plan to create an air-gapped laptop with a separate bootloader that is on a permanently write-protected SD card that I will carry in my pocket all the time.

I will also remove the wireless card on the motherboard. The only thing that makes me unsettled is the BIOS. It's a pretty old BIOS and doesn't even support UEFI.

I can't be sure about its integrity, so I thought, can't I just pour silicone to protect the BIOS chip? To prevent flashing new firmware I can just use a hard password.

| improve this question | | | | |
  • 1
    You're don't appear to be considering whether the firmware might have exploits, which is a possibility. Although you haven't said what threat you're trying to protect against, which might render your efforts moot (say, if your attacker would consider rubber-hose cryptography). For one thing, unless you completely verify the hardware every time you gain possession of the laptop, doing any modification is worthless - an attacker may add an extra chip that proxies the SD cart slot, for example. Write-protection is enforced at the OS-level, so an attacker could still modify it... – Clockwork-Muse Dec 30 '19 at 6:42
  • You need to define what you want to protect against. If someone has physical access to the laptop, won't they just take out the data drive and walk away? – schroeder Dec 30 '19 at 8:12
  • @schroeder I will be using encryption for that. – heathcliff Dec 30 '19 at 10:09
  • So, you need to describe what you want to protect against. – schroeder Dec 30 '19 at 10:25
  • Or your data isn't that interesting, and you are going overboard with all those protections, or they are very interesting and the sophisticated attacker will have no trouble cutting thru them all. Unless you specify who is the attacker and what kind of data you are protecting, we cannot offer any advice. – ThoriumBR Jan 29 at 13:38

A mildly sophisticated attacker could drill through the silicone/epoxy to get to the programming pins. Real tamper-resistant hardware needs to have some sort of active detection for this to actually make a difference. For example, the ORWL has a brittle cover around the security-sensitive components, and when it detects that the cover has been removed or damaged, it wipes all of its sensitive data.

| improve this answer | | | | |
  • I think I can use a small Arduino with a motion sensor. Don't care about the encrypted data but I shouldn't be entering the password if the laptop was turned upside down for example. – heathcliff Dec 30 '19 at 10:13
  • A motion sensor is both prone to false positives and bypassable by accelerating it slowly enough. Anything you do to fix one of those problems will make the other worse. (And the attacker could hold your laptop still while taking the table out from under it.) – Joseph Sible-Reinstate Monica Dec 30 '19 at 15:57
  • What about a proximity sensor? It will send a radio wave to another Arduino if the case was ever opened. Then when I want to check after coming home, I can push the button a few times as my combination, and can see status. A power bank that is always connected to the wall charger would be enough. In case the attacker realizes the server Arduino and shuts it, the Arduino will respond if its uptime is lower than a certain amount. – heathcliff Dec 30 '19 at 16:06
  • Do work in a Faraday cage. No EM signals in or out. – LTPCGO Jan 7 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.