Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!
Or if someone tries (evil maid) to modify the /boot then he has to power off my machine, but later I will notice that! Are there any backdoors of this concept?
They don't have to power off your machine to disconnect (not necessarily remove) the hard disk from your notebook and reconnect it to a different machine, modify the /boot partition, and then reconnect it to your notebook. As long as the notebook is sleeping, it won't even notice. On your next boot, you could be compromised. There are methods to remove SDRAM and read its contents. Of course these take a moderately sophisticated attacker.
I see no obvious flaw in your reasoning. However, this scenario requires you to always have your notebook near power supply. An attack as you stated might be carried out anyways with you thinking it powered down because the battery was low.
Considering the hard disk is down, an attacker could modify the "Please enter password" part in your boot-loader to log passwords. This would, of course, never trigger if you always kept your notebook switched on.
Also, leaving your machine unattended and not suspended might pose other security risks as well. A common scenario would be Firewire which as DMA (direct memory access). Other possibilities would be faulty handlers of other external devices like USB (autostart etc.).
I'm curious if anyone has some suggestions on lower-level attack techniques that might require more knowledge in electrical engineering than I can spare right now ;) Could one disassemble and tap something with the RAM still powered on maybe?
An attacker within ~15 meters, on the same electric network (e.g. within the same HPFI breaker circuit) can sniff your keystrokes provided you have any physical connection. I.e. powersupply, and to some extent ethernet. These can be picked up in the 10-16.7KHz range using cheap equipment. See http://www.blackhat.com/presentations/bh-usa-09/BARISANI/BHUSA09-Barisani-Keystrokes-SLIDES.pdf And of course, modern electric control systems are often online, and accessible to your utility company.
If you're going full tinfoil, disconnect your device (at least when entering master passwords) and use wireless networking and battery power. You can use bandpass filters to trim the 10-16.7KHz leakage, see hamradio.stackexchange, or introduce lots of noise into your AC network (coughmedium power spark gap transmittercough), OR pass your power into a modified PSU (which should have several other noisy loads connected - you can use a bank of transistors which all switch $_something - 12V LEDs are actually quite noisy because they throw a spark - in the 10-16KHz range), then out into an inverter to feed your laptop powerbrick, but I suggest you do something beneficial instead of worrying too much about spooks and nerds. That quest is ne'erending.
Edit: Some people have devised a cunning method for being able to verify whether their system has been tampered with, e.g. when passing customs, where a laptop may be of interest. See https://www.wired.com/2013/12/better-data-security-nail-polish/ This glitter stuff needs only be photographed with a high resolution camera for comparison, and provides an exotic absolute yes/no to the question 'has my system been tampered with in my absence?'.
