Compromising the UEFI recovery partition

Question

I have a Windows 10 OS, drives are encrypted with the latest version. UEFI is not encrypted, and I have recently installed a BIOS update.

I wonder about the possibility of a hacker (if secure boot is disabled) to change the files of the UEFI partition and to alter the BIOS recovery files and therefore use the reset ability to install a malicious BIOS or to alter other files in the UEFI partition that can lead to compromise the whole system or to break VeraCrypt security.

Note that in my system secure boot can be disabled any time due to the ability to reset the power-on password by default by computer manufacturer.

Answer 1

All of the hacking of UEFI (and the bios) that you mention is possible in pretty much the way you describe.

However, for full support for full disk encryption, the system should also have a TPM. The TPM measures the system as it boots with a cryptographic hash at each stage. The bios is measured, the bios settings are measured, the bios of all the devices is measured, the first stage boot loader from the EFI paritition and its settings are measured, etc.

If the TPM is being used, the decryption key for the hard drive is stored in the TPM, and when it is stored, it is itself encrypted with some combination of the measurements from the boot process. So if any of those stages have been altered, the hard drive key will not correctly decrypt inside the tpm, and the unlocking of the encrypted hard drive will fail.

In an enterprise environment, a recovery key may be stored elsewhere, for instance in active directory.

Without a TPM, or if the TPM is not used, typically a boot password must be entered to decrypt the harddrive and continue booting. You would still be vulnerable to a hacked bios.