SoylentNews is people
SoylentNews
from the who-watches-your-laptop-when-you-are-in-the-shower? dept.
Submitted via IRC for SoyCow1984
Hacker lore is littered with tales of mysterious attackers breaking into hotels—perhaps at a conference—to get their hands on someone’s laptop with the goal of installing malware on it by physically connecting to the machine. That’s why the more careful hackers never leave their laptops unattended at events, or bring disposable computers with little to nothing valuable on them.
These types of attacks are called evil maid attacks in the infosec world, because the imaginary attacker is someone who has access to your room and malicious intentions. Pwning a laptop via physical access is a true and tested method to hack someone. But there’s no better way to be reminded of how effective and sometimes effortless these attacks can be than an actual demo.
In early July, security firm Eclypsium posted a video showing how Mickey Shkatov, one of its researchers, hacks into a laptop by opening it up, connecting a device directly to the chip that contains the BIOS, and installing malicious firmware on it—all in just over four minutes. That easy. (In some cases hackers don’t even need to open up the laptop).
“Physical attacks are hard to defend against and most people aren’t doing anything to defend against them,” John Loucaides, Eclypsium’s vice president of engineering, told me. “It’s not that hard of a attack to pull of as most people think. It takes less time and less effort than most people realize.”
[...] The good news is that while it’s relatively easy to hack a laptop once you get your hands on it, it’s all the work that is required to get there (monitoring a target to see where they live or are sleeping, breaking into their room, etc) makes these attacks likely rare.
(Score: 0) by Anonymous Coward on Sunday August 12 2018, @07:58PM
I'd suspect that Will E. McCracker, a pretty intelligent guy and for this reason using at least a double safety net of Tor/VPN to mitigate the risk of being caught doing his evil blackhat stuff online, will be extra careful when exposing himself in meatspace. He'll have worked out the perfect time to get some guaranteed alone time with the machine. If he's extra paranoid, he might be working with an accomplice to watch and in case of an unforeseen early return, delay and distract the mark.
And if it's Bob The Spook who's running the show he'll likely be extremely efficient, with a highly optimized set of tools and exploits. He might use some hush-hush government backdoors *cough*Management Engine*cough* and be in and out the door before you can retie your shoes. With a full surveillance team providing cover from bad surprises.