Quick answer: An evil maid attack occurs when someone gains temporary physical access to an unattended device and secretly modifies it so they can capture secrets or regain access later. A classic target is the boot process of an encrypted laptop: the attacker plants a false password prompt or changes trusted code, then retrieves the credential during a later visit. Defense requires physical custody, a verified boot chain, encryption, shutdown, and a response plan for suspected tampering.
Why it is called an evil maid attack
The name describes a scenario, not a real occupation: a traveler leaves a laptop in a hotel room and an intruder with authorized-looking access tampers with it. The same threat exists in offices, conferences, repair shops, shipping, border inspections, shared homes, vehicles, and any location where a device is outside the owner’s control.
The attacker may have one visit or repeated access. In the classic two-visit version, the first visit installs an implant and the second retrieves a captured password or compromised device. Other attacks can extract accessible data immediately.
What physical access enables
- booting from external media or changing boot components;
- modifying firmware, recovery environments, or peripheral devices;
- installing a hardware keylogger or malicious USB accessory;
- removing storage for offline copying or modification;
- accessing memory and keys when a device is running or sleeping;
- replacing the device with a similar-looking system or changing its security settings.
Not every physical-access attempt succeeds. Modern hardware protections raise cost and produce evidence, but the risk depends on attacker skill, time, tools, device state, and the organization’s threat model.
Why full-disk encryption is not enough
Full-disk encryption is essential for protecting data when the device is powered off and the key is unavailable. It does not automatically prove that the software asking for the unlock secret is genuine. If boot code or firmware is modified, a convincing false prompt can record the passphrase and still continue the normal boot.
A sleeping device may retain encryption keys in memory and expose active sessions. A device that is already unlocked offers even more opportunity. Shutting down before losing custody generally gives disk encryption and boot verification their strongest chance to help.
Layered defenses
- Maintain custody. Carry high-risk devices with you or use controlled storage with access logging. A hotel safe is a delay, not proof of integrity.
- Shut down fully. Do not rely on sleep during travel or other elevated-risk periods.
- Use supported full-disk encryption. Protect recovery keys separately and require strong authentication appropriate to risk.
- Enable Secure Boot and measured boot. Keep firmware, bootloaders, TPM firmware, and recovery components updated. Monitor attestation failures where managed platforms support it.
- Consider a pre-boot PIN. TPM plus PIN can reduce automatic key release after a stolen device or changed boot state, but deployment needs recovery planning.
- Restrict alternate boot and ports. Disable unnecessary external boot, Thunderbolt, and debugging paths. Firmware passwords add friction but are not an absolute barrier to hardware access.
- Use tamper evidence. Numbered seals, photographs, asset markings, and chassis inspection can reveal changes when applied and checked consistently.
High-risk travel practices
Carry the minimum data and privileges needed. Use a dedicated travel device, short-lived credentials, and remote access to protected data rather than local copies when appropriate. Avoid using a privileged administrator identity from a device that may leave your control. Keep security keys and recovery material separate from the laptop.
Before travel, record hardware identifiers and known boot measurements where the organization supports them. After an uncontrolled inspection or loss of custody, follow a defined check-in procedure instead of immediately signing in to sensitive services.
What to do if tampering is suspected
- Do not enter a password. A modified prompt may be designed to capture it.
- Disconnect networks. Do not attach corporate VPN, removable drives, or trusted accessories.
- Document visible evidence. Photograph seals, ports, screws, boot messages, and unexpected accessories without dismantling the device.
- Contact the security team from another device. Preserve chain of custody and let qualified personnel acquire firmware, disk, and hardware evidence.
- Protect identities. Revoke sessions and rotate credentials that may have been used after the suspected access.
- Rebuild or replace when integrity is uncertain. Reinstalling the operating system does not correct every firmware or hardware implant.
Common misconceptions
A BIOS password alone does not stop removal or replacement of components. Tamper tape does not prevent access; it provides evidence only if inspected. Secure Boot verifies configured trust relationships but cannot compensate for every vulnerable or compromised firmware component. The right control set depends on whether the likely attacker is an opportunistic thief, insider, skilled technician, or well-resourced targeted actor.
Frequently asked questions
Does physical access always mean compromise?
No, but it creates opportunities that remote controls cannot address. Treat unexplained access according to the device’s sensitivity and threat model.
Is shutdown safer than sleep?
Yes for most loss-of-custody scenarios because active sessions and disk keys are less likely to remain available.
Can antivirus detect an evil maid attack?
Endpoint tools may find operating-system changes, but firmware, boot, peripheral, and hardware tampering may require attestation and specialist inspection.