An evil maid attack is an attack on an unattended device, in which an attacker with physical access alters it in some undetectable way so that they can later access the device, or the data on it. The name refers to the scenario where a maid could subvert a device left unattended in a hotel room – but the concept itself also applies to situations such as a device being intercepted while in transit, or taken away temporarily by airport or law enforcement personnel. Overview Origin In a 2009 blog post, security analyst Joanna Rutkowska coined the term "Evil Maid Attack"; due to hotel rooms being a common place where devices are left unattended. The post detailed a method for compromising the firmware on an unattended computer via an external USB flash drive – and therefore bypassing TrueCrypt disk encryption. D. Defreez, a computer security professional, first mentioned the possibility of an evil maid attack on Android smartphones in 2011. He talked about the WhisperCore Android distribution and its ability to provide disk encryption for Androids. Notability In 2007, former U.S. Commerce Secretary Carlos Gutierrez was allegedly targeted by an evil maid attack during a business trip to China. He left his computer unattended during a trade talk in Beijing, and he suspected that his device had been compromised. Although the allegations have yet to be confirmed or denied, the incident caused the U.S. government to be more wary of physical attacks. In 2009, Symantec CTO Mark Bregman was advised by several U.S. agencies to leave his devices in the U.S. before travelling to China. He was instructed to buy new ones before leaving and dispose of them when he returned so that any physical attempts to retrieve data would be ineffective. Methods of attack Classic evil maid The attack begins when the victim leaves their device unattended. The attacker can then proceed to tamper with the system. If the victim's device does not have password protection or authentication, an intruder can turn on the computer and immediately access the victim's information. However, if the device is password protected, as with full disk encryption, the firmware of the device needs to be compromised, usually done with an external drive. The compromised firmware then provides the victim with a fake password prompt identical to the original. Once the password is input, the compromised firmware sends the password to the attacker and