--- id: CP-089 slug: evil-maid-laptop-hotel-attack lang: en title: Evil Maid attack on a hotel laptop description: How someone left alone for a few minutes with a laptop in a hotel room can compromise it, and what to do about it. canonical_url: https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/ markdown_url: https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Evil Maid attack on a hotel laptop", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-056 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/ fr: https://startbrain.io/cyberpedia/fr/articles/evil-maid-ordinateur-hotel/ de: https://startbrain.io/cyberpedia/de/articles/evil-maid-laptop-hotel/ es: https://startbrain.io/cyberpedia/es/articles/evil-maid-ordenador-hotel/ sources: - "n": 1 title: Secure the Windows boot process publisher: Microsoft url: https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process accessed: "2026-11-03" - "n": 2 title: BitLocker countermeasures publisher: Microsoft url: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures accessed: "2026-11-03" - "n": 3 title: "Pre-OS Boot: Bootkit, Sub-technique T1542.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1542/003/ accessed: "2026-11-03" - "n": 4 title: BitLocker Overview publisher: Microsoft url: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ accessed: "2026-11-03" - "n": 5 title: "Pre-OS Boot: System Firmware, Sub-technique T1542.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1542/001/ accessed: "2026-11-03" - "n": 6 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 7 title: SP 800-147B, BIOS Protection Guidelines for Servers publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/147/b/final published: "2014-08-28" accessed: "2026-11-03" --- # Evil Maid attack on a hotel laptop The name "Evil Maid" describes a simple situation: a laptop is left alone in a hotel room, and someone gets at it for a few minutes. The device is off or locked, and nothing seems to have moved. Yet a change made before Windows starts escapes the protections that the system applies only once it is running [1]. Boot malware, the "bootkits", can in fact start before Windows, bypass system security and stay hidden [1]. This article explains the principle, what you see on screen and the reflexes that reduce the risk. The sources cited here describe no specific hotel case: the dated cases below are real attacks of the same type (modification of the boot process or of the firmware, plugged-in hardware), not hotel scenes. ## In 30 seconds - Where it happens: a laptop left unattended (hotel room, meeting room, car), even when off or locked. - What the attacker wants: to place code that runs before the system, to steal data, passwords or the disk encryption key [1][2]. - The reflex: do not leave the device alone, shut it down completely before walking away and use a startup PIN if the IT department offers one [2]. - If it has already happened: if the device asks for a recovery key for no known reason, tell the IT department before using it again. ## Straight answers ### Can a device that is switched off really be attacked? Yes, if its boot process is not protected. An attacker with raw access to the boot disk can overwrite the area holding the loader and redirect execution to their own code [3]. On a UEFI device, they can create or modify files on the EFI system partition to run malicious code at kernel level [3]. ### What is the attacker trying to get? Rootkits, of which bootkits are one kind, often come with other malware able to bypass local logins, record passwords and keystrokes, transfer private files and capture cryptographic data [1]. ### Is disk encryption enough? It protects the data on a lost or stolen device, including against a software attack tool or moving the disk to another machine [4]. Microsoft states that BitLocker protects by default against a bootkit being installed by someone with physical access: the TPM observes the modification and the key is not released [2]. The same document notes that the "TPM only" mode is more convenient but less secure than the options that require a second factor [2]. ### What is a TPM? It is a chip designed to provide basic security functions, mainly around encryption keys. BitLocker binds its keys to it to check that the device was not modified while the system was offline [2]. ## Inside the attacker's head The attacker has little time and physical access. Microsoft distinguishes two profiles. The first is the opportunistic attacker: they use no destructive method and no sophisticated analysis tool, and the shape of the device (no external port capable of direct memory access, no visible screw, soldered memory) limits their options [2]. The second has skills and prolonged access: they open the case, solder and use specialised hardware or software [2]. On some systems, bypassing the "TPM only" mode may require opening the case and soldering, at a reasonable cost; bypassing a TPM protected by a PIN costs more and forces the attacker to guess the PIN [2]. Several routes exist. The first modifies the boot sector or the EFI partition so that hostile code runs before the system [3]. The second targets the firmware (BIOS or UEFI): means exist to overwrite it, which can give sophisticated attackers persistence that is hard to detect [5]. The third adds hardware. MITRE notes that many penetration-testing teams use accessories able to inject keystrokes or read kernel memory through direct memory access (DMA), and that public references of use by real attackers are rare [6]. ## What you see on screen Nothing specific is described. The sources cited here describe no particular fake screen. They do say, however, that a rootkit that starts before the system can hide completely [1]. The BitLocker PIN entry screen is itself a step that comes before Windows [4], so at the same place where malicious boot code would run. One landmark exists all the same: with the "TPM only" mode, if BitLocker detects a change in the BIOS or UEFI configuration, in critical boot files or in the boot configuration, it switches to recovery mode and asks for the recovery password [2]. An unexpected recovery screen therefore deserves a report. So does an unknown accessory plugged into the device, since such an accessory can inject keystrokes [6]. ## Under the hood At startup, the firmware first finds the system loader. Without Secure Boot, the PC runs the one on the disk and cannot know whether it belongs to a trusted system or to a rootkit [1]. With Secure Boot, the firmware checks the loader's signature before launching it [1]. Bootkits replace or modify this loader. On a classic BIOS, they touch the Master Boot Record (MBR) or the Volume Boot Record (VBR); on a UEFI, they create or modify files on the EFI partition [3]. Firmware rootkits overwrite the BIOS or another hardware firmware to start before Windows [1]. NIST ranks unauthorised modification of the BIOS among the significant threats, because of the BIOS's privileged position in the PC architecture [7]. The defences form a chain. Secure Boot launches only trusted loaders, Trusted Boot then checks each boot component, and Measured Boot logs the startup so that a trusted server can assess the state of the PC [1]. BitLocker relies on the TPM's measurement: an unauthorised EFI firmware, boot application or loader can neither run nor obtain the key [2]. If the attacker modifies the boot configuration database to point to a decoy system, BitLocker cryptographically checks that the recipient of the key is the right system [2]. The startup PIN adds a second factor. BitLocker loads keys into memory only once pre-boot authentication is complete, and the TPM limits repeated attempts to counter brute force [2]. The PIN also helps against attacks through DMA ports and memory remanence [2]. ## Case files The sources cited here give no dated hotel case. They cite real attacks of the same nature, with the date of the reference shown on the page. ### Hacking Team, 2015: a rootkit in the BIOS MITRE cites a UEFI BIOS rootkit developed by the company Hacking Team to keep remote access software on certain targeted systems [5]. The associated reference is an article dated 13 July 2015 [5]. ### LoJax: a UEFI rootkit seen in the wild (reference from September 2018) LoJax is a UEFI BIOS rootkit deployed to keep remote access software on certain targeted systems [5]. MITRE's reference is an ESET article from September 2018 titled "LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group" [5]. ### DarkVishnya: hardware plugged in on site (reference from December 2018) DarkVishnya physically plugged a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops into an organisation's environment to gain access to its local network [6]. The reference is an analysis dated 6 December 2018 on banks attacked through a direct connection to the local network [6]. ### WhisperGate, January 2022: a hijacked boot loader WhisperGate overwrites the MBR with a loader component that wipes hard drives and displays a fake ransom demand at startup [3]. Most of MITRE's references on this case date from January 2022, one from February 2022 [3]. ## The right reflexes - Do not leave the device alone. - Shut it down completely or put it into hibernation before walking away. In simple sleep mode, programs and documents stay in memory and the PIN is not asked for again on wake-up; in hibernation, the disk is locked [2]. - If your organisation allows it, use encryption with a startup PIN. The "TPM only" mode is the default and targets the opportunistic attacker; against an attacker with skills and time, Microsoft recommends a TPM with PIN, sleep disabled and a shutdown or hibernation before leaving the device [2]. - Keep Secure Boot on: turning it off does not protect against bootkits [1]. Microsoft also recommends requiring a password to change BIOS settings [2]. - On your return, if the device behaves differently (recovery prompt, unknown accessory), report it to the IT department before reconnecting it. A bootkit sits below the system and can make a full clean-up difficult [3]. ## Sources 1. Microsoft, "Secure the Windows boot process". https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process (accessed 3 November 2026) 2. Microsoft, "BitLocker countermeasures". https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures (accessed 3 November 2026) 3. MITRE ATT&CK, "Pre-OS Boot: Bootkit, Sub-technique T1542.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1542/003/ (accessed 3 November 2026) 4. Microsoft, "BitLocker Overview". https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Pre-OS Boot: System Firmware, Sub-technique T1542.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1542/001/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 7. NIST, "SP 800-147B, BIOS Protection Guidelines for Servers", 28 August 2014. https://csrc.nist.gov/pubs/sp/800/147/b/final (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.