Thwarting the "evil maid"

LWN.net needs you!

Without subscribers, LWN would simply not exist. Please consider signing up for a subscription and helping to keep LWN publishing.

The "evil maid" attack against disk encryption has been known for quite a few years now. We looked at it back in 2009, shortly after Joanna Rutkowska (who first described the attack) announced a proof-of-concept "evil maid" attack on the popular TrueCrypt disk-encryption tool. In 2011, she also came up with an "Anti Evil Maid" tool; more recently, Matthew Garrett has come up with some refinements that he calls "Anti Evil Maid 2 Turbo Edition". These methods for stopping evil maids (and others with physical access to our systems) are worth a look.

The "evil maid" attack got its name from a scenario where the maid at a hotel (or someone pretending to be) would access a guest's laptop while they were out of their room. The attacker would install a kind of malware in the master boot record (MBR) of the system that would record the decryption password. Another visit is all it would take for the attacker to get the password (and perhaps to decrypt some data). More sophisticated attacks might send the password to the attacker over the network. Some way to access the disk's data, now that it can be decrypted, would need to be arranged (e.g. copy the disk at installation time, steal the laptop later, etc.).

Ensuring the code being run by the system is the same as what is expected is the only mechanism to thwart many of these kinds of attacks. Using the Trusted Platform Module (TPM) hardware that is present on many systems these days can provide a way to ensure that the system's firmware, bootloader, and other code involved in the disk encryption have not changed. Garrett described how the TPM can be used:

If any of those components has been modified, the TPM measurement by the previous component will detect it. In addition, the TPM can be used to encrypt some data that it will only decrypt if all of the PCR values match their expected values. So an encrypted key for the disk could be stored in such a way that it can only be decrypted if the system has not been modified. So far, so good.

But, either the disk decryption key is applied automatically at boot time, which leaves the system open to simply being stolen and booted, or a password can be applied to the boot process. However, that leaves another problem behind, as Garrett outlined:

This is where Rutkowska's Anti Evil Maid comes into play. Users can encrypt a secret phrase with the TPM, which can be used in one of two forms. It can be stored on a USB stick that is consulted whenever the user believes there is a reason to check the integrity of their system. If the TPM can decrypt the phrase, then all is well. That does, however, require the user to decide when to check, which is not fully reliable.

An alternative is to do it on every boot, but that has its flaws as well. The attacker could simply boot the system, see the phrase, and modify their malware to simply print the proper phrase. That can also be handled by password-protecting the TPM, but that results in the scenario where a fake password prompt is offered, the password is stored, the malware removes itself, and the system is rebooted. As Garrett noted, users can be trained to recognize the attack: "if the system reboots without the user seeing the secret, the user must assume that their system has been compromised and that an attacker now has a copy of their TPM password."

The usability of that mechanism is not all that good, though. Garrett has come up with his "Turbo Edition" that adds a dynamic element into the mix, so that both the user and the computer can independently agree on a password that changes frequently. As he pointed out, many already use a one-time password (OTP) for two-factor authentication. In that scenario, users prove to the computer that they can generate the proper OTP, while Garrett's mechanism would reverse that: the computer would prove that it can generate the proper OTP to show that it hasn't been compromised.

Garrett has created a prototype that uses the time-based OTP (TOTP) algorithm to generate the passwords. TOTP takes a secret and the time of day to generate the OTP. That secret can be encrypted by the TPM so it will only be available if the system has not been tampered with. Enrolling the secret into a TOTP smartphone app allows the user to generate the same OTP. So instead of a static secret phrase that gets decrypted and printed to the screen (which a physically present attacker could learn), the boot process calculates an OTP and prints that to the screen, which the user verifies on their smartphone. An attacker who learns an OTP will have no advantage as long as the user is diligent about verifying the OTP on every boot.

It is a clever combination of two existing security technologies that should work well, once all of the pieces are in place. As Garrett pointed out, there are caveats:

There is an alternative to all of these complicated "Anti Evil Maid" techniques, of course: maintaining physical control of laptops (or other systems) at all times. That is a tall order for most people; for the truly paranoid (or targeted), though, it is the safest course. But, for that to be effective, any loss of control, even for a short time, has to result in the system being discarded as "compromised". Obtaining a new, trusted system and retrieving the data from backups will be required, though now the system used for backups is the big target—and may be far harder to prevent physical access to.