Hacker News new | past | comments | ask | show | jobs | submit login

The problem with this technique is that now you have to inspect the seal every time you leave your laptop unattended.



I think that's quite obvious. You say that as if there were alternatives.

Are there any other, more convenient techniques to defend against evil maid attacks?


Thinkpads have a little switch under the bottom cover that will get flipped up when the cover is removed. There is a BIOS setting to require a password whenever this switch is toggled. When combined with signed BIOS updates it seems like it would be hard to bypass on a short term (like an actual "evil maid" attack).


In the most extreme case, the evil maid replaces your laptop with an exact replica that does nothing more than somehow bridge USB devices via radio to the original to take care of keyboard input and the smart card. Sounds like paranoid scifi, sure, and you can debate how unlikely that is and then go ahead and accept that risk, but the random mosaic actually protects against that, while all other suggestions I have heard so far do not.

Edit: Also, even though we have been discussing only computers so far, the random mosaic method can protect anything. The top level comment shows how a similar approach can be used in pharmacology.


Make the BIOS run a checksum of all the hardware.

Automatically clear some memory when the laptop is opened so the BIOS can tell.

Put important parts inside an epoxy. Add some transformer wire in the epoxy that will break when somebody tries to tamper with it.

I'm not trying to be exhaustive. But stuff like that.


You cannot trust the BIOS after an evil maid attack. And there can be sniffers on the physical layer inside the laptop.


DRTM, SMM attestation and remote attestation have evil maid attacks in their threat model, with a firmware TPM or SoC enclave that isn't subject to mitm.

Password keystroke surveillance (from sniffer, optical cameras or RF WiFi Sensing) can be mitigated by removable 2FA/smartcard.

TEMPEST info leakage from displays, components or RF implants can be measured, as SDRs and machine learning lower decoding costs, https://news.ycombinator.com/item?id=41116682

Some enterprise PCs can detect when the case cover is opened, e.g. http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf


All of those really reduce the risk. But I wouldn't trust them to be able to stop the CIA, KGB, or whatever the Chinese equivalent is.


Nation-state attackers can afford to exploit zero-day vulnerabilities that bypass OS security protections.


Ok, you can make every chip/device communicate with each other using some challenge-response authentication.


Acknowledging that security and convenience are inversely proportional I like the products from this company, they specialize in cash/bank/legal document protection bags that are easy to use without taking additional effort.

https://arifkin.com/

A locking briefcase (a cylinder key lock with 7 pins? - not sure of the correct terminology here)) may not stop an expert locksmith, but otherwise you can tell if the contents have been accessed. I have a fabric one (heavy duty fabric, cannot be torn by hand) with a zipper that is locked by key. I keep my notebook computer in it when I travel, either in the trunk of my car or my hotel room.

Or, when I took a multi-day train trip a few years ago, every time I had to leave my "roomette" (open access) and travel a few train cars away for a meal or sightseeing, I made sure the laptop was in the locked briefcase.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: