1

My laptop BIOS is password protected. Probably the password can be bypassed using some hardware and software means. But is it possible that somebody having access to laptop but not knowing the password can bypass it without me knowing it when I log on at a later stage ? I am trying to protect my laptop from malware / spyware. I am concerned about spying. Since important folders are encrypted, I am not worried about data theft. Attacker may have 10-12 hours of time.

1
  • 2
    First you should define your threat model. What are you trying to protect (Data on your disk? Prevent them from installing malware? etc.)? What can the attacker do (How much time? Are they unobserved? Level of technical expertise? etc.) – CodesInChaos Jan 20 '14 at 12:30
1

Yes it's possible.

BIOS passwords are not usually taken seriously by manufacturers as a meaningful security measure on their own, since most people don't take care to secure their systems physically. Instead it's expected to act as a deterrent in cases where physical accessibility is reduced, such as public access terminals in schools or offices, to prevent users from tampering with settings that could case maintainers a headache.

if an attacker can get hold of your device he could apply hardware debugging techniques to extract your current password, or as is much more likely, install a keylogger and wait for you to enter the password for him.

If you want to secure your device against attackers bypassing the BIOS password, you should lock it away in a tamper proof hard case, which will allow you to determine if an attacker has had physical access to the device.

5
  • If password is reset or changed I will come to know. I will not come to know only when attacker gets to know the password. How is that going to happen ? – user2917687 Jan 20 '14 at 12:23
  • @user2917687 The attacker could simply remove the HDD and create a copy. Or (even if it's using TrueCrypt) modify it to add a trojan. Or add a hardware keylogger. – CodesInChaos Jan 20 '14 at 12:28
  • 1
    @user2917687 The attacker isn't dumb, they know if they reset/change the password you will be able to tell. That's why instead they'll simply obtain your password with a keylogger. – deed02392 Jan 20 '14 at 12:33
  • oh... u r talking about hardware keylogger. – user2917687 Jan 20 '14 at 12:34
  • Indeed. In terms of security, it is safe to assume if an attacker has physical access to your device (ideally on at least two occasions), he owns your device and all its data, regardless of any encryption. – deed02392 Jan 20 '14 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.