Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
By definition evil maid attacks involve altering a device in an undetectable way. So if I lock the BIOS, set the HDD to boot first and put a HDD password will this prevent it?
Access to the computer won't be possible as the HDD would be the first to boot and would ask for a password, so no one could try and brute force the BIOS password.And if some one tries to reset the BIOS password then I will find out as it will become clear to me the password has been removed.
If an attacker has complete physical access, they could take out your drive, and from another computer, remove the password and access the drive; the ATA password spec may prevent BIOSes from allowing drive access, but there are readily available tools that can simply remove this protection. Even if this feature actually protected the drive, the drive's firmware could be tampered with or replaced, or perhaps the adversary could go to the trouble of putting the disk platters into another drive that is not locked.
Even if they couldn't get the drive to work, maybe they could find a way to install malware into the UEFI/BIOS, or install some hardware keylogger that allows them to enter your passwords at a later time.
To summarize, while this may be effective against a casual intruder, someone with enough time, equipment, and expertise will not be stopped by these protections.
It will raise the bar, requiring a rather talented Evil Maid but it won't entirely prevent it.
First there's non HDD related approaches such as a hardware keylogger interfaced with the keyboard, as well as a camera watching you enter the password.
As far as the HDD related approach. The BIOS password becomes irrelevant if I directly attach your HDD to my machine.
The HDD password makes things a good deal trickier. The HDD password is written to a vendor configuration control track not accessible by standard SATA disk commands. The easiest way to get to it is to have the manufacturer's custom interface software that can issue the non-standard commands. In most cases the password is even stored in the clear. There are other ways to do it without the manufacturer's code but it can be slow and tedious.
For better security, look into UEFI Secure Boot.
