Support Tech Chop by doing your Amazon shopping at http://amazon.techchop.com!

A few weeks ago in episode 28 we looked at a few ways to hack Truecrypt volumes, and one way to hack Truecrypt full hard drive encryption. All three of those weren't too practical in my opinion so I kept searching for methods for breaking in and I found a really cool one!

Allow me to introduce you to Evil Maid! From their page:

Let’s assume we have a reasonably paranoid user, that uses full disk encryption on his or her laptop, and also powers it down every time they leave it alone in a hotel room, or somewhere else. 

Now, this is where our Evil Maid stick comes into play. All the attacker needs to do is to sneak into the user’s hotel room and boot the laptop from the Evil Maid USB Stick. After some 1-2 minutes, the target laptop’s gets infected with Evil Maid Sniffer that will record the disk encryption passphrase when the user enters it next time. As any smart user might have guessed already, this part is ideally suited to be performed by hotel maids, or people pretending to be them.

This tool was introduced in 2009, but has been rendered obsolete by the latest version of Truecrypt (7.1a at the time of this writing). The example we give you in the video is against a laptop with Truecrypt 6.3a installed. When we tried it against 7.1a Evil Maid corrupted the boot loader.

We contacted the creator of Evil Maid, Joanna Rutkowska, and she said that she will not be making any updates to Evil Maid. That being said, the open source code is available here  (Evil Maid Code) if any of you are interested in taking up the project.

If you want to download the Evil Maid USB image and try it out yourself, you can find it available for download here: (Evil Maid Infector)

It's best to write the image to your USB stick by running the following dd command on a Linux machine:

dd if=evilmaidusb.img of=/dev/sdX

Of course make sure you change /dev/sdX to the USB stick you are using, mine was /dev/sdb1 for example. Once written, just boot up to your USB drive and press "E" when prompted. It really couldn't be simpler.