How to Avoid an Evil-Maid Attack | Total Security

-

How to Avoid an Evil-Maid Attack | Total Security


Protect Your Business Computers From Unauthorized Physical Access. 

An Evil-Maid attack is the most primitive type of attack there is, but it is also one of the most unpleasant. Watching out for her prey (a device left unattended), the "malicious maid" tries to steal confidential information or install spyware or a remote access tool to enter the corporate network. This article will show you how to protect yourself from intruders.


Classic Example

In December 2007, a delegation from the US Department of Commerce visited Beijing to discuss the common strategy to be adopted to combat piracy. However, when he returned to the United States, the secretary's laptop had spyware that could only be installed by someone who had physical access to the device. The owner of the laptop said he never left the device throughout negotiations and only left it in his (safe) hotel room during meal times on the ground floor.


In theory, a professional only needs 3-4 minutes to infect a device, but things like this tend to happen when the computer is left unattended and unlocked (or not password protected). . Even when basic safety precautions are followed closely, the attack by the malicious maid is likely to be successful.


How Cyber ​​Criminals Access Information

There are many methods of obtaining sensitive information. They depend on the age of the computer and the security software installed. For example, old devices incompatible with Secure Boot can be restarted from external devices and find themselves powerless against Evil-Maid attacks. Secure Boot is usually enabled by default on modern computers.


Communication ports compatible with fast data exchange or direct interaction with device memory can be used as siphons to extract personal data or trade secrets. Thunderbolt, for example, has a very fast data transmission speed thanks to direct memory access, which opens the door to Evil-Maid-type attacks.


Last spring, IT security expert Björn Ruytenberg explained how to hack any active Thunderbolt in a Windows or Linux device, even if it is locked and connections from unknown devices through external ports are disabled. Gutenberg's method, nicknamed Thunderspy, assumes that the scammer can physically access the device and must rewrite the controller firmware.


With Thunderspy, the cybercriminal has to reprogram the Thunderbolt chip with their firmware version. The new program disables the built-in protection and the hacker takes full control of the device.


In theory, the kernel's DMA protection policy fixes the vulnerability but some users do not use it (and those with an operating system older than Windows 10 cannot install it). However, Intel announced a solution to the problem: Thunderbolt 4.


A good old USB drive can also be an attack vector. A miniature device, inserted into a USB port, activates when the user turns on the computer and launches the BadUSB attack.


If the information that the cybercriminal seeks to obtain is very valuable, he may even try to perform a particularly difficult and expensive task: steal the device and replace it with a similar one that already contains the spyware. It is true that the victim will quickly realize it but in general, it only happens after he has entered the password. Fortunately, as we have pointed out, it is both complicated and expensive to set up such an exchange.


How To Reduce The Risks

The easiest and most effective way to protect yourself from Evil-Maid attacks is to keep your computer in a safe place that no one else has access to except you. For example, if possible, avoid leaving it in your hotel room. On the other hand, if your employees need to take a business trip and borrow the company's laptops, here are some tips to reduce the risk:


Use temporary laptops that don't have access to critical business systems or work data, then format the hard drive and reinstall the operating system after each trip.

Ask your employees to turn off laptops as soon as they leave them.

Encrypt the hard drives of all computers that leave company offices.

Install security solutions that block any suspicious outgoing traffic.

Check that your security solution detects BadUSB attacks (which is the case with  Protegent360 Total Security for Business )

Update all programs, especially the operating system, as soon as possible.

Limit direct access to device memory through FireWire, Thunderbolt, PCI, and PCI Express ports on all devices that allow it.


Comments

Post a Comment

Popular posts from this blog

Why Not to Restart Your Computer if It Is Infected With the Ransomware | Total Security

-
Image
The Internet has made our lives easy, especially in the field of online buying and selling, but with simplicity come greater challenges. One of the main issues that come with shopping online is its security concerns. So far this year, more than a thousand shoppers in Australia alone have reported cases of online shopping fraud, and 56.6 percent of those cases come with massive financial losses. As the Internet has become our daily tool for trading, investing, and consuming content, we cannot stop buying and selling online, although we are at risk of phishing from scammers who get richer by defrauding users, so we can do a lot to prevent our money from being stolen and defrauded. Buying from various online stores. This article provides practical advice for smart shopping online. These tips are classified into two parts: 1- Prevention Tips - How to protect yourself from fraud and deception while shopping on the Internet? 2- Tips - What do you do after being deceived? 1- How to protect yo...
Read more

What Is a Ransomware Virus and How Do You Protect Your Computer From It | Total Security

-
Image
The attacker then demands a ransom from the victim to regain access to the data upon payment in a virtual currency such as Bitcoin. You are presented with instructions on how to pay a fee to obtain the decryption key. Costs can range from a few hundred dollars to thousands, and you pay cybercriminals in Bitcoin. What are the types of ransomware? Depending on the result of the attack, ransomware can be classified into the following categories: Locker Ransomware: ransomware that shuts down your system and demands a ransom is classified to give you access to locker ransomware. Crypto-Ransomware: This type of ransomware encrypts your files and forces you to pay a specified amount of money to decrypt your files. The victim is required to pay for the anti-virus program that removes this virus. Ransomware Android Mobile Device: This type of ransomware either permanently close your mobile phone or steals its sensitive data, and requires a ransom to unlock it or to return the data. IoT Ransomwa...
Read more

What is a zero-day threat? Free Antivirus Software

-
Image
Day zero refers to the time since the vulnerability was discovered by software developers. There are two types of zero-day threats. A zero-day vulnerability is a software security flaw that can be reproduced in a browser or application. A zero-day attack is an attempt to install malware on a victim's computer by exploiting a zero-day vulnerability in the program. How Do Zero-Day Threats Arise? As the name suggests, a zero-day vulnerability is not yet known to the developer, antivirus companies, or the general public - zero-day attacks are carried out by cybercriminals who were among other things, vulnerabilities in browsers and e-mail clients are especially often exploited in zero-day attacks due to their widespread distribution among users. How to Recognize a Zero-day Attack? Once discovered by users and developers, these are no longer zero-day threats! This is why zero-day attacks are one of the most difficult types of threats with the most devastating consequences today, but the...
Read more