Evil Maid Attack
Evil Maid Attack Definition
An evil maid attack happens when an attacker gets brief physical access to an unattended device and secretly tampers with it. The goal is to steal data from it or set up a way to access the device remotely at a later time. Evil maid attacks are executed quickly and leave very few traces to reduce the risk of the owner noticing anything is happening.
The name was coined in 2009 by a security analyst, Joanna Rutkowska. It refers to a hypothetical scenario in which a maid could compromise a device left unattended in a hotel room. However, an evil maid attack could take place anywhere the device is away from the owner, like at an airport inspection, for example.
How an Evil Maid Attack Works
Once an attacker has the device, they may:
- Copy the data stored on it
- Install malware to access the device at a later time
- Add a keylogger to record everything typed on it
- Change startup or firmware settings to take control before the operating system loads
These attacks typically happen over very short periods of time but can leave long-lasting effects.
Evil Maid Attack Types
- Data theft: Harvesting data directly from the device, typically possible only if the device doesn’t have password protection or full disk encryption.
- Malware infection: Installing malware on the device to allow the attacker to remotely access the device.
- Keyloggers: Collecting everything the device’s owner types on the keyboard to get sensitive data, including the target’s passwords.
- Bootkits: Hiding malware in the device’s startup code to gain control once the device is booted up. Since it works before the operating system starts up, a bootkit could avoid some antivirus software.
- Firmware infection: Tampering with firmware like BIOS or UEFI to capture device credentials and gain control before the operating system starts.
Read More
FAQ
Evil maid attacks are usually hard to discover, as they’re often devised to be very quick and leave as few tracks as possible. They may sometimes leave some subtle physical clues, like a loosened screw or new scratches on the laptop case. The device could also take longer to boot if its firmware was tampered with in the attack.
Yes, it can. One type of evil maid attack involves setting up a keylogger on the device. It records all keyboard input, which can include passwords. An evil maid attack can also tamper with the device’s firmware or booting process. This goes around the device’s operating system, so it can bypass full disk encryption on the device.
Evil maid attacks typically target laptops because they’re portable and are frequently left unattended in places like hotel rooms or offices. Also, laptops usually have USB ports, which can be used to plug in a malicious USB drive. Smartphones and tablets can also be potential targets, but they’re easier to carry in a pocket or a bag, so they’re less likely to be left unattended long enough.
45-Day Money-Back Guarantee