1

FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI partition remains unencrypted).

Most sources state that EFI boot mode (with secure boot enabled) is more secure than legacy boot mode. Is this also true in a FDE setup?

I'm asking in the context of a "cold" evil maid attack, where the attacker gets physical access to the shut down computer. Will he be able to tamper the unencrypted EFI partition successfully? E. g. installing a keylogger to gain access to my encrypted data at a later point in time...

1
  • If the attacker has physical access he could just install a hardware keylogger or maybe a camera. There have also been multiple bugs in the past where "secure" boot could be bypassed.
    – secfren
    Commented Dec 22, 2022 at 10:17

2 Answers 2

1

Both MBR and GPT disks (generally used for BIOS/CSM and UEFI, respectively) require one region that is not encrypted. The system-verification/key-unwrapping/decryption code has to live somewhere that isn't itself encrypted, after all! The distinction between putting the decryption code into a small primary partition (~100MB for Bitlocker) or just stuffing the entire decryption code into the ~1MB of technically unpartitioned space at the start of the disk (Veracrypt), vs. using the UEFI System partition, is essentially meaningless.

Unfortunately, this applies to evil maid attacks too. There are integrity checks in this code to try to detect when it's been tampered with, but they are inherently insufficient; an attacker can simply replace the unencrypted boot-time code with modified code that lacks such checks (and also steals your encryption key). Again, there's no difference between MBR and GPT disks, here.

The reason Secure Boot is more secure is because it prevents tampering with the bootloader / decryption code, unless the attacker can install a signed replacement where the signature is verifiable with a key that the UEFI trusts. Still, that has nothing to do with the difference between encryption on MBR vs. GPT; it's just that secure boot, as implemented on x86-family systems, requires GPT.


Bottom line:

If you aren't using Secure Boot, booting in UEFI mode from a GPT disk with an encrypted OS installation is no more secure than booting in BIOS or CSM mode from an MBR disk with an encrypted OS installation. If you are using Secure Boot, you need to also restrict access to the system setup utility to prevent an attacker from installing their own trusted certificate for modified boot code, else a moderately sophisticated attacker with unattended physical access could pull off an "evil maid" attack anyhow.

2
  • 1
    Your first sentence is not correct. In non-EFI mode TC/VC will encrypt the EFI partition too. Both partitions will show up as RAW instead of NTFS if you plug the drive to some other PC. Unfortunately, the old boot process was much more secure in this regard. Also see: veracrypt.eu/en/System%20Encryption.html (text at the bottom).
    – user136036
    Commented Jul 17, 2023 at 11:36
  • 1
    @user136036 OK, when VC reserves the first track of an MBR disk (for its "VeraCrypt Boot Loader") this doesn't technically involve leaving any partition decrypted (I do wonder where it puts the original MBR, but that's not important, there's ways to handle that). However, that's purely semantics; the decryption code is still in a part[ition] of the disk that is not encrypted, can't be encrypted (or there'd be no way to decrypt on boot!). I'll tweak the wording though.
    – CBHacking
    Commented Jul 18, 2023 at 8:43
0

If the attacker has full physical access and BIOS/EFI access they may as well install their own MOK certificate and modify your bootloader/install their own boot loader, so if you have reasons to believe it has happened, you need to reset secure boot certificate storage. So here's another caveat, EFI/BIOS password.

Modern day enterprise laptops have measures against tampering with UEFI [secure boot] certificates: i.e. if you install a BIOS password it's near impossible to do anything nefarious as it's not dependent on the internal CR2032 battery almost all PCs and most laptops use to keep the internal clock running and also for keeping BIOS/EFI settings after you unplug the power cord.

But yes in the end UEFI boot is more secure when Secure Boot is enabled/enforced and proper certificates. With the BIOS boot all the bets are off.

Even with Secure Boot the attacker can modify the BCD boot configuration for e.g. Windows 10/11 but that won't give them too much ground if any. If you have unpartioned space it's possible to insert a fake OS which will ultimately boot your Windows installation and install a keylogger or any other rootkit. However I've not heard of such attacks yet, maybe it's not worth it or it's exceptionally difficult.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .