1

FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI partition remains unencrypted).

Most sources state that EFI boot mode (with secure boot enabled) is more secure than legacy boot mode. Is this also true in a FDE setup?

I'm asking in the context of a "cold" evil maid attack, where the attacker gets physical access to the shut down computer. Will he be able to tamper the unencrypted EFI partition successfully? E. g. installing a keylogger to gain access to my encrypted data at a later point in time...

Improve this question
1
  • If the attacker has physical access he could just install a hardware keylogger or maybe a camera. There have also been multiple bugs in the past where "secure" boot could be bypassed.
    – secfren
    Dec 22, 2022 at 10:17

2 Answers 2

Reset to default
1

Both MBR and GPT disks (generally used for BIOS/CSM and UEFI, respectively) require one partition that is not encrypted. The system-verification/key-unwrapping/decryption code has to live somewhere that isn't itself encrypted, after all! The distinction between creating a small (~100MB for Bitlocker; not sure about Veracrypt) primary partition in MBR and putting the bootloader/decryption code there, vs. using the UEFI System partition, is essentially meaningless.

Unfortunately, this applies to evil maid attacks too. There are integrity checks in this code to try to detect when it's been tampered with, but they are inherently insufficient; an attacker can simply replace the unencrypted boot-time code with modified code that lacks such checks (and also steals your encryption key). Again, there's no difference between MBR and GPT disks, here.

The reason Secure Boot is more secure is because it prevents tampering with the bootloader / decryption code, unless the attacker can install a signed replacement where the signature is verifiable with a key that the UEFI trusts. Still, that has nothing to do with the difference between encryption on MBR vs. GPT; it's just that secure boot, as implemented on x86-family systems, requires GPT.

Bottom line:

If you aren't using Secure Boot, booting in UEFI mode from a GPT disk with an encrypted OS installation is no more secure than booting in BIOS or CSM mode from an MBR disk with an encrypted OS installation. If you are using Secure Boot, you need to also restrict access to the system setup utility to prevent an attacker from installing their own trusted certificate for modified boot code, else a moderately sophisticated attacker with unattended physical access could pull off an "evil maid" attack anyhow.

Improve this answer
0

If the attacker has full physical access and BIOS/EFI access they may as well install their own MOK certificate and modify your bootloader/install their own boot loader, so if you have reasons to believe it has happened, you need to reset secure boot certificate storage. So here's another caveat, EFI/BIOS password.

Modern day enterprise laptops have measures against tampering with UEFI [secure boot] certificates: i.e. if you install a BIOS password it's near impossible to do anything nefarious as it's not dependent on the internal CR2032 battery almost all PCs and most laptops use to keep the internal clock running and also for keeping BIOS/EFI settings after you unplug the power cord.

But yes in the end UEFI boot is more secure when Secure Boot is enabled/enforced and proper certificates. With the BIOS boot all the bets are off.

Even with Secure Boot the attacker can modify the BCD boot configuration for e.g. Windows 10/11 but that won't give them too much ground if any. If you have unpartioned space it's possible to insert a fake OS which will ultimately boot your Windows installation and install a keylogger or any other rootkit. However I've not heard of such attacks yet, maybe it's not worth it or it's exceptionally difficult.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .