I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the files? I think it doesn’t encrypt the /bios partition - is that a problem? I’ve seen some articles about some Evil Maid attack as well?
If the attacker has physical access to your PC they can:
- Implant a HW keyboard logger and you're completely compromised.
- Alter the initrd (inital ramdisk) - the so called Evil Maid attack and implant any malware.
- They can potentially alter your UEFI firmware and implant undeletable malware which cannot be detected by your OS.
If you're concerned about this, the best protection would be do use Apple hardware, i.e. MacBook or certified Google Chromebooks. They have protections against 2 and 3, but 1 is still possible though extremely complicated.
You can encrypt the /boot partition with LUKS1 and thus protect initial ramdisk and kernel image from tempering. It requires GRUB2.
I don't think vanilla Ubuntu installation can set this up (I wouldn't trust Ubuntu for managing my security anyway).
But, I have never looked into the security implication of using LUKS1 over LUKS2. And even though, attack surface is limited, GRUB2 might have vulnerabilities too prior to decryption.
Of course that does not protect against hardware tempering or firmware tempering for example.
Some documentation: https://wiki.archlinux.org/title/Dm-crypt/Specialties
My opinion is that disk encryption is only good to encrypt data at disk in case the disk (computer) is stolen.