4 ms·

I think that's quite obvious. You say that as if there were alternatives. Are there any other, more convenient techniques to defend against evil maid attacks?

amelius 2y ago
Make the BIOS run a checksum of all the hardware. Automatically clear some memory when the laptop is opened so the BIOS can tell. Put important parts inside an epoxy. Add some transformer wire in the epoxy that will break when somebody tries to tamper with it. I'm not trying to be exhaustive. But stuff like that.
- mr_mitm 2y ago
  You cannot trust the BIOS after an evil maid attack. And there can be sniffers on the physical layer inside the laptop.
  - walterbell 2y ago
    DRTM, SMM attestation and remote attestation have evil maid attacks in their threat model, with a firmware TPM or SoC enclave that isn't subject to mitm. Password keystroke surveillance (from sniffer, optical cameras or RF WiFi Sensing) can be mitigated by removable 2FA/smartcard. TEMPEST info leakage from displays, components or RF implants can be measured, as SDRs and machine learning lower decoding costs, https://news.ycombinator.com/item?id=41116682 https://news.ycombinator.com/item?id=41116682 Some enterprise PCs can detect when the case cover is opened, e.g. http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf
    - rocqua 2y ago
      All of those really reduce the risk. But I wouldn't trust them to be able to stop the CIA, KGB, or whatever the Chinese equivalent is.
      - walterbell 2y ago
        Nation-state attackers can afford to exploit zero-day vulnerabilities that bypass OS security protections.
  - deleted 2y ago
    [deleted]
  - amelius 2y ago
    Ok, you can make every chip/device communicate with each other using some challenge-response authentication.
PopAlongKid 2y ago
Acknowledging that security and convenience are inversely proportional I like the products from this company, they specialize in cash/bank/legal document protection bags that are easy to use without taking additional effort. https://arifkin.com/ https://arifkin.com/ A locking briefcase (a cylinder key lock with 7 pins? - not sure of the correct terminology here)) may not stop an expert locksmith, but otherwise you can tell if the contents have been accessed. I have a fabric one (heavy duty fabric, cannot be torn by hand) with a zipper that is locked by key. I keep my notebook computer in it when I travel, either in the trunk of my car or my hotel room. Or, when I took a multi-day train trip a few years ago, every time I had to leave my "roomette" (open access) and travel a few train cars away for a meal or sightseeing, I made sure the laptop was in the locked briefcase.
surteen 2y ago
Thinkpads have a little switch under the bottom cover that will get flipped up when the cover is removed. There is a BIOS setting to require a password whenever this switch is toggled. When combined with signed BIOS updates it seems like it would be hard to bypass on a short term (like an actual "evil maid" attack).
- mr_mitm 2y ago
  In the most extreme case, the evil maid replaces your laptop with an exact replica that does nothing more than somehow bridge USB devices via radio to the original to take care of keyboard input and the smart card. Sounds like paranoid scifi, sure, and you can debate how unlikely that is and then go ahead and accept that risk, but the random mosaic actually protects against that, while all other suggestions I have heard so far do not. Edit: Also, even though we have been discussing only computers so far, the random mosaic method can protect anything. The top level comment shows how a similar approach can be used in pharmacology.

amelius 2y ago

Make the BIOS run a checksum of all the hardware. Automatically clear some memory when the laptop is opened so the BIOS can tell. Put important parts inside an epoxy. Add some transformer wire in the epoxy that will break when somebody tries to tamper with it. I'm not trying to be exhaustive. But stuff like that.

mr_mitm 2y ago
You cannot trust the BIOS after an evil maid attack. And there can be sniffers on the physical layer inside the laptop.
- walterbell 2y ago
  DRTM, SMM attestation and remote attestation have evil maid attacks in their threat model, with a firmware TPM or SoC enclave that isn't subject to mitm. Password keystroke surveillance (from sniffer, optical cameras or RF WiFi Sensing) can be mitigated by removable 2FA/smartcard. TEMPEST info leakage from displays, components or RF implants can be measured, as SDRs and machine learning lower decoding costs, https://news.ycombinator.com/item?id=41116682 https://news.ycombinator.com/item?id=41116682 Some enterprise PCs can detect when the case cover is opened, e.g. http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf
  - rocqua 2y ago
    All of those really reduce the risk. But I wouldn't trust them to be able to stop the CIA, KGB, or whatever the Chinese equivalent is.
    - walterbell 2y ago
      Nation-state attackers can afford to exploit zero-day vulnerabilities that bypass OS security protections.
- deleted 2y ago
  [deleted]
- amelius 2y ago
  Ok, you can make every chip/device communicate with each other using some challenge-response authentication.

PopAlongKid 2y ago

Acknowledging that security and convenience are inversely proportional I like the products from this company, they specialize in cash/bank/legal document protection bags that are easy to use without taking additional effort. https://arifkin.com/ https://arifkin.com/ A locking briefcase (a cylinder key lock with 7 pins? - not sure of the correct terminology here)) may not stop an expert locksmith, but otherwise you can tell if the contents have been accessed. I have a fabric one (heavy duty fabric, cannot be torn by hand) with a zipper that is locked by key. I keep my notebook computer in it when I travel, either in the trunk of my car or my hotel room. Or, when I took a multi-day train trip a few years ago, every time I had to leave my "roomette" (open access) and travel a few train cars away for a meal or sightseeing, I made sure the laptop was in the locked briefcase.

surteen 2y ago

Thinkpads have a little switch under the bottom cover that will get flipped up when the cover is removed. There is a BIOS setting to require a password whenever this switch is toggled. When combined with signed BIOS updates it seems like it would be hard to bypass on a short term (like an actual "evil maid" attack).

mr_mitm 2y ago
In the most extreme case, the evil maid replaces your laptop with an exact replica that does nothing more than somehow bridge USB devices via radio to the original to take care of keyboard input and the smart card. Sounds like paranoid scifi, sure, and you can debate how unlikely that is and then go ahead and accept that risk, but the random mosaic actually protects against that, while all other suggestions I have heard so far do not. Edit: Also, even though we have been discussing only computers so far, the random mosaic method can protect anything. The top level comment shows how a similar approach can be used in pharmacology.