What steps need to be taken to protect a computer from quick attacks that involve physical access?
(Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; also I'm only interested in very time limited attacks in this question)
The scenario is protecting my devices (laptops, desktops, mobiles) from stealthy "drive by" attacks in semi-trusted environments. Quick in this context is < ~30 seconds. In particular I consider this to exclude any attacks that involve opening the case. A couple of real-world scenarios for context:
- Laptop on table in café whilst at the counter
- Desktop at home when potentially untrusted people could have brief access whilst I'm out of the room
I'm mostly interested in anything that compromises integrity, but confidentiality of data stored in memory (volatile or non-volatile) is also of interest. Don't care about availability, as I have an attack in mind.
Please be clear on any differences between Windows and Linux (recent Ubuntu, if it's relevant).
I have a few things in mind already, but have some questions about some of them.
- Account logins + screen lock of some kind is a prerequisite
- Thunderbolt, Firewire and ExpressCard/PCMCIA allow Direct Memory Access so should be disabled. Can anything be done if you don't want to disable one of the interfaces?
- Disable autorun on Windows so you can't run executables from storage devices (anything equivalent to do on Ubuntu? Does this apply to Windows 7 + 8?)
- If I've got a separate keyboard / mouse, physical key-loggers are going to be a problem.
- Any storage devices (e.g. USB sticks, external HDs, SD cards) could be swapped out / briefly accessed and (pre-determined) interesting files copied
- For touchscreen devices, I can assume any unlock pattern and potentially pin could have been stolen, but probably minimal time to make use of it if this was the first visit.
- Ditto for fingerprint unlock devices (definitely no time to reproduce it if this is the first time a fingerprint has been obtained)
Do I need to worry about Windows automatically installing device drivers for certain classes of device - e.g. a USB device that pretends to be a printer and provides its own device driver?