1

By definition evil maid attacks involve altering a device in an undetectable way. So if I lock the BIOS, set the HDD to boot first and put a HDD password will this prevent it?

Access to the computer won't be possible as the HDD would be the first to boot and would ask for a password, so no one could try and brute force the BIOS password.And if some one tries to reset the BIOS password then I will find out as it will become clear to me the password has been removed.

Improve this question
2

If an attacker has complete physical access, they could take out your drive, and from another computer, remove the password and access the drive; the ATA password spec may prevent BIOSes from allowing drive access, but there are readily available tools that can simply remove this protection. Even if this feature actually protected the drive, the drive's firmware could be tampered with or replaced, or perhaps the adversary could go to the trouble of putting the disk platters into another drive that is not locked.

Even if they couldn't get the drive to work, maybe they could find a way to install malware into the UEFI/BIOS, or install some hardware keylogger that allows them to enter your passwords at a later time.

To summarize, while this may be effective against a casual intruder, someone with enough time, equipment, and expertise will not be stopped by these protections.

Improve this answer
10
  • Or in other words ‘once you got physical access all bets are off’ – LvB Sep 22 '20 at 23:26
  • Your recent edit addressing the HDD password suggests that the password is in the drive firmware. This is incorrect. – user10216038 Sep 23 '20 at 15:15
  • @user10216038 good call, I had read a source that is clearly inaccurate. – multithr3at3d Sep 24 '20 at 16:49
  • To install malware on the BIOS they would need to remove the BIOS password first. Is this correct? Thus alerting me that my laptop has been tampered with. – Linux_user0987 Oct 5 '20 at 19:23
  • @Linux_user0987 not necessarily, could depend on things such as vulnerabilities, or hardware access – multithr3at3d Oct 5 '20 at 20:34
1

It will raise the bar, requiring a rather talented Evil Maid but it won't entirely prevent it.

First there's non HDD related approaches such as a hardware keylogger interfaced with the keyboard, as well as a camera watching you enter the password.

As far as the HDD related approach. The BIOS password becomes irrelevant if I directly attach your HDD to my machine.

The HDD password makes things a good deal trickier. The HDD password is written to a vendor configuration control track not accessible by standard SATA disk commands. The easiest way to get to it is to have the manufacturer's custom interface software that can issue the non-standard commands. In most cases the password is even stored in the clear. There are other ways to do it without the manufacturer's code but it can be slow and tedious.

For better security, look into UEFI Secure Boot.

Improve this answer
1
  • Why do you think UEFI Secure Boot would help anything? You even mentioned yourself hardware keyloggers. – Joseph Sible-Reinstate Monica Sep 23 '20 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.