Detect Evil Maid Attacks: Do Not Disturb

Among the most effective ways to undermine a computer is with physical accessibility. A lot of people have probably left our notebooks unattended (possibly in a hotel room when traveling?). It would be wonderful to know if someone tried to hack on it! Don’t Disturb (DND) continually monitors your system for events which may indicate a precursor of”wicked maid” assault. Especially, it watches for’lid open’ occasions.

If you have closed your notebook (and consequently triggered sleep mode), then nearly all physical accessibility attacks may need the lid to be opened for the attack to be successful. Such attacks could comprise:

Again, the majority of these attacks take a closed notebook to be opened…either to alert it (i.e. to process a malicious apparatus ) or to allow the attacker to interact with the notebook! As with any security instrument, proactive or direct efforts to especially bypass DND’s protections will probably succeed. Additionally, any attack that doesn’t require opening the lid of a closed notebook will stay undetected.

Future versions will expand DND’s observation and detection capabilities (possibly alerting on electricity occasions, USB insertions, etc).

Don’t Disturb, may also discover unauthorized access by not as wicked adversaries…like one’s mother.

As soon as an unauthorized lid available event is discovered DND will locally log this function. It may be configured to:

  • Locally exhibit an alarm
  • Remotely send an alarm to a documented iDevice
  • Execute a specified activity (i.e. conduct a script, etc.. )
  • Monitor for interesting events, including new procedures, USB insertions, fresh logins, etc..

Don’t Disturb, by design, doesn’t distinguish between authorized or unauthorized lid available occasions. That’s to say, it is going to alert you whenever your notebook’s lid has been opened (unless configured, to discount upon a thriving touch ID authentication occasion ).

Compatibility: OS X 10.12+

You May Also Like

About the Author: Steve West