Is it necessary to have hard drive and bios passwords if you also have full disk encryption, or maybe at least the hard drive password is unnecessary because there would be two passwords protecting essentially the same thing?
asked Oct 15, 2011 at 10:45
Add a comment
|
2 Answers
BIOS passwords are fairly pointless as soon as someone has undisturbed physical access to your machine. Most mainboards have a switch or a jumper that you can use to reset the CMOS; if that fails, you'll most likely be successful by removing the CMOS battery and waiting a few seconds - usually the BIOS password is then either cleared or reset to a (google-known) default. If this also fails, the easy solution is to remove the harddisk from the original system and mount it on another machine.
The only value of a BIOS password is to prevent (legit) users from fiddling with BIOS settings in a supervised situation (e.g. public computers: opening up one of these and removing the HDD is going to be noticed, but one can usually get away with getting the computer to reboot and then entering the BIOS). In other words: A BIOS password only protects if physical access to the machine is limited.
The hard drive password (that is, the passphrase you use to unlock the full-disk encryption) is necessary, and if you have set it up properly, it doesn't matter where you mount the disk, you will always need the passphrase to make sense of the data (that, or brute-force the encryption). Even with unlimited physical access to the entire machine, full-disk encryption needs to be broken in order to get to the data.
-
"you'll most likely be successful by removing the CMOS battery and waiting a few seconds" - which modern motherboards still have BIOS batteries?– DanBealeCommented Oct 16, 2011 at 22:00
-
some have a simply jumper that does exactly the same of removing the battery Commented Oct 17, 2011 at 17:12
-
1
-
1@DanBeale Yours too has a battery of some sort, otherwise the clock would have to be re-adjusted at every boot. Commented Mar 20, 2012 at 5:24
-
@CamiloMartin - here's one board where battery is optional if cord is left connected (motherboards.org/files/manuals/7/ax6bc-ol-e.pdf) if the cord is disconnected you lose the RTC info but everything else is stored to EEROM. Here's an article which mentions capacitors used instead of batteries. (tomshardware.com/reviews/…) Here's a laptop that doesn't have motherboard battery (uses main battery or a capacitor) (support.apple.com/kb/TA25911?viewlocale=en_US).– DanBealeCommented Mar 27, 2012 at 11:53
I mostly agree with @tdammers, however BIOS passwords are actually very useful for the typical builds you get in large corporates. An attacker who has physical access in this sort of scenario will not be able to just disable it by removing the CMOS battery - as to reset them actually requires the corporate reset code.
This is quite an important control - for some high value attacks, the attacker would need to gain access to the device, steal data or implement some kind of exploit, then hide their tracks and leave the machine in a state where the intrusion is not discovered. With the BIOS password, an EVIL MAID attack is much harder to carry out.
answered Oct 15, 2011 at 22:27
