Arch Linux

Problem

Since USB drives are not write-once, an evil maid can easily replace the whole content of the drive with something else, letting an unaware user install an already compromised system.

More in general any system residing on disks in a BIOS or UEFI computer not protected with secure boot seems vulnerable to this kind of attack.

Encryption is not relevant as defense since the attacker can always replace the bootloader and the kernel to acquire the necessary data from the user himself. [1]

Proposed solution

The easiest feasible mitigation I've found for maids able to alter or replace storage (NB: I suppose we're just scratching the surface here) is to move kernel, bootloader, checksums and signatures on a separate safe dongle device.

This solution is implemented in https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/279.

While people are usually not concerned about physical attackers, we should explicitly advice users not to use any single writable drive setup for more than a couple sessions and always refer them to an iso+dongle buildmodes combo, or simply enable it by default.

References

[1] Fitting Everything Together, Lennart Poettering, 2021
https://0pointer.net/blog/fitting-everything-together.html