So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!

Or if someone tries (evil maid) to modify the /boot then he has to power off my machine, but later I will notice that! Are there any backdoors of this concept?

3 Answers 3


They don't have to power off your machine to disconnect (not necessarily remove) the hard disk from your notebook and reconnect it to a different machine, modify the /boot partition, and then reconnect it to your notebook. As long as the notebook is sleeping, it won't even notice. On your next boot, you could be compromised. There are methods to remove SDRAM and read its contents. Of course these take a moderately sophisticated attacker.


I see no obvious flaw in your reasoning. However, this scenario requires you to always have your notebook near power supply. An attack as you stated might be carried out anyways with you thinking it powered down because the battery was low.

Considering the hard disk is down, an attacker could modify the "Please enter password" part in your boot-loader to log passwords. This would, of course, never trigger if you always kept your notebook switched on.

Also, leaving your machine unattended and not suspended might pose other security risks as well. A common scenario would be Firewire which as DMA (direct memory access). Other possibilities would be faulty handlers of other external devices like USB (autostart etc.).

I'm curious if anyone has some suggestions on lower-level attack techniques that might require more knowledge in electrical engineering than I can spare right now ;) Could one disassemble and tap something with the RAM still powered on maybe?


An attacker within ~15 meters, on the same electric network (e.g. within the same HPFI breaker circuit) can sniff your keystrokes provided you have any physical connection. I.e. powersupply, and to some extent ethernet. These can be picked up in the 10-16.7KHz range using cheap equipment. See http://www.blackhat.com/presentations/bh-usa-09/BARISANI/BHUSA09-Barisani-Keystrokes-SLIDES.pdf And of course, modern electric control systems are often online, and accessible to your utility company.

If you're going full tinfoil, disconnect your device (at least when entering master passwords) and use wireless networking and battery power. You can use bandpass filters to trim the 10-16.7KHz leakage, see hamradio.stackexchange, or introduce lots of noise into your AC network (coughmedium power spark gap transmittercough), OR pass your power into a modified PSU (which should have several other noisy loads connected - you can use a bank of transistors which all switch $_something - 12V LEDs are actually quite noisy because they throw a spark - in the 10-16KHz range), then out into an inverter to feed your laptop powerbrick, but I suggest you do something beneficial instead of worrying too much about spooks and nerds. That quest is ne'erending.

Edit: Some people have devised a cunning method for being able to verify whether their system has been tampered with, e.g. when passing customs, where a laptop may be of interest. See https://www.wired.com/2013/12/better-data-security-nail-polish/ This glitter stuff needs only be photographed with a high resolution camera for comparison, and provides an exotic absolute yes/no to the question 'has my system been tampered with in my absence?'.

  • Moderators: I know I answered out of scope of OPs question, but if he worries about evilmaid attacks, he may as well be aware of keyboard leakage into his electric network. Master passwords shouldn't leak, but they most assuredly do:)
    – user2497
    May 4, 2017 at 21:45
  • this does not address the question
    – schroeder
    May 4, 2017 at 21:49
  • @schroeder now it does. I knew you were going to scold me.
    – user2497
    May 4, 2017 at 21:51
  • you fail to mention that the paper you link to found leakage in PS/2 keyboards ....
    – schroeder
    May 4, 2017 at 21:52
  • Yes, mea culpa. PS/2 uses 10-16.7KHz. Can we agree that USB keyboards are ~48MHz?
    – user2497
    May 4, 2017 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.