In her recent blog Joanna Rutkowska describes a proof of concept code to attack Truecrypt system disk encryption. The blog also mentions “the concept behind the Evil Maid Attack is neither new, nor l33t in any way”, however since the POC is now published we expect script kiddies to jump on this opportunity and tweak this code to their own advantage.
As always, to protect our user base we looked into a possible AV detection mechanism in case the system is compromised, to alert the user. Obviously an AV cannot prevent an Evil maid attack, but alerting a user on the first reboot after such an infection can go a long way in preventing the data loss.
We now detect this proof-of-concept code as trojan PWS-EvilMaid!demo, due to its password stealing capabilities. We will be watching this space for any future variants that follow this trend, for now here is the screenshot of McAfee alerting the user once the machine is infected, it is recommended to reinstall Truecrypt if you see this detection.
Protect what you value!
