removes itself after a reboot. In order to successfully complete the attack, the attacker must return to the device once it has been unattended a second time to steal the now-accessible data. Another method of attack is through a DMA attack in which an attacker accesses the victim's information through hardware devices that connect directly to the physical address space. The attacker simply needs to connect to the hardware device in order to access the information. Network evil maid An evil maid attack can also be done by replacing the victim's device with an identical device. If the original device has a bootloader password, then the attacker only needs to acquire a device with an identical bootloader password input screen. If the device has a lock screen, however, the process becomes more difficult as the attacker must acquire the background picture to put on the lock screen of the mimicking device. In either case, when the victim inputs their password on the false device, the device sends the password to the attacker, who is in possession of the original device. The attacker can then access the victim's data. Vulnerable interfaces Legacy BIOS Legacy BIOS is considered insecure against evil maid attacks. Its architecture is old, updates and Option ROMs are unsigned, and configuration is unprotected. Additionally, it does not support secure boot. These vulnerabilities allow an attacker to boot from an external drive and compromise the firmware. The compromised firmware can then be configured to send keystrokes to the attacker remotely. Unified Extensible Firmware Interface Unified Extensible Firmware Interface (UEFI) provides many necessary features for mitigating evil maid attacks. For example, it offers a framework for secure boot, authenticated variables at boot-time, and TPM initialization security. Despite these available security measures, platform manufacturers are not obligated to use them. Thus, security issues may arise when these unused features allow an attacker to exploit the device. Full disk encryption systems Many full disk encryption systems, such as TrueCrypt and PGP Whole Disk Encryption, are susceptible to evil maid attacks due to their inability to authenticate themselves to the user. An attacker can still modify disk contents despite the device being powered off and encrypted. The attacker can modify the encryption system's loader codes to steal passwords from the victim. The ability to create a communication channel between the bootloader and the operating system to remotely steal the password for a disk