protected by FileVault 2, is also explored. On a macOS system, this attack has additional implications due to “password forwarding” technology, in which a user's account password also serves as the FileVault password, enabling an additional attack surface through privilege escalation. Thunderbolt In 2019 a vulnerability named "Thunderclap" in Intel Thunderbolt ports found on many PCs was announced which could allow a rogue actor to gain access to the system via direct memory access (DMA). This is possible despite use of an input/output memory management unit (IOMMU). This vulnerability was largely patched by vendors. This was followed in 2020 by "Thunderspy" which is believed to be unpatchable and allows similar exploitation of DMA to gain total access to the system bypassing all security features. Any unattended device Any unattended device can be vulnerable to a network evil maid attack. If the attacker knows the victim's device well enough, they can replace the victim's device with an identical model with a password-stealing mechanism. Thus, when the victim inputs their password, the attacker will instantly be notified of it and be able to access the stolen device's information. Mitigation Detection One approach is to detect that someone is close to, or handling the unattended device. Proximity alarms, motion detector alarms, and wireless cameras, can be used to alert the victim when an attacker is nearby their device, thereby nullifying the surprise factor of an evil maid attack. The Haven Android app was created in 2017 by Edward Snowden to do such monitoring, and transmit the results to the user's smartphone. In the absence of the above, tamper-evident technology of various kinds can be used to detect whether the device has been taken apart – including the low-cost solution of putting glitter nail polish over the screw holes. After an attack has been suspected, the victim can have their device checked to see if any malware was installed, but this is challenging. Suggested approaches are checking the hashes of selected disk sectors and partitions. Prevention If the device is under surveillance at all times, an attacker cannot perform an evil maid attack. If left unattended, the device may also be placed inside a lockbox so that an attacker will not have physical access to it. However, there will be situations, such as a device being taken away temporarily by airport or law enforcement personnel where this is not practical. Basic security measures such