3 ms·
You cannot trust the BIOS after an evil maid attack. And there can be sniffers on the physical layer inside the laptop.
by mr_mitm 2y ago
You cannot trust the BIOS after an evil maid attack. And there can be sniffers on the physical layer inside the laptop.
- walterbell 2y agoDRTM, SMM attestation and remote attestation have evil maid attacks in their threat model, with a firmware TPM or SoC enclave that isn't subject to mitm. Password keystroke surveillance (from sniffer, optical cameras or RF WiFi Sensing) can be mitigated by removable 2FA/smartcard. TEMPEST info leakage from displays, components or RF implants can be measured, as SDRs and machine learning lower decoding costs, https://news.ycombinator.com/item?id=41116682 https://news.ycombinator.com/item?id=41116682 Some enterprise PCs can detect when the case cover is opened, e.g. http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf
- rocqua 2y agoAll of those really reduce the risk. But I wouldn't trust them to be able to stop the CIA, KGB, or whatever the Chinese equivalent is.
- walterbell 2y agoNation-state attackers can afford to exploit zero-day vulnerabilities that bypass OS security protections.
- deleted 2y ago[deleted]
- amelius 2y agoOk, you can make every chip/device communicate with each other using some challenge-response authentication.