Skip to main content

Lab 2.3: Alternative Boots and Physical Access Attacks

Learning Objectives​

By the end of this lab, you will be able to:

  • Boot from different media (USB, ISO)
  • Access Windows system files without a password
  • Understand Evil Maid attacks
  • Configure Secure Boot and firmware protection
  • Assess the importance of disk encryption

Estimated Duration​

35 minutes

Prerequisites​

  • Functional Windows 10/11 VM
  • Windows recovery ISO or Hiren's Boot CD
  • Understanding of Lab 2.1 (bypass password)

Professional Context​

Physical access to a machine represents a major security risk. This lab explores techniques used by:

  • Forensic analysts (with authorization)
  • Data recovery technicians
  • Attackers with temporary physical access
  • Security auditors

Legitimate use cases:

  • Data recovery on damaged machines
  • Authorized forensic investigation
  • Physical security testing
  • Demonstrating risks to users

IMPORTANT:

The techniques in this lab allow access to a computer's files without knowing the password. This is LEGAL only:

  • On your own machine or VM
  • With explicit written permission from the owner
  • As part of an investigation authorized by a warrant

ILLEGAL:

  • Accessing someone else's files without permission
  • Stealing personal or confidential data
  • Installing backdoors on others' machines

Consequences: Prison and significant fines (Criminal Code, art. 342.1, 430)

Part 1: Understanding the Boot Process​

Step 1.1: Normal Boot Sequence​

Process recap:

  1. Press power button → Power supplies the motherboard
  2. BIOS/UEFI runs → Firmware on the motherboard
  3. POST (Power-On Self Test) → Hardware test
  4. Search for bootloader → In defined boot order
  5. Bootloader starts → Windows Boot Manager, for example
  6. OS loads → Windows starts

Typical boot order:

  1. Internal hard drive (C:)
  2. CD/DVD
  3. USB
  4. Network (PXE)

Step 1.2: Modify Boot Order​

Why it's important:

If an attacker can boot from USB BEFORE the hard drive:

  • They start THEIR operating system
  • They can access ALL files on the hard drive
  • Without ever going through the Windows login screen!

Access BIOS/UEFI on your VM:

VirtualBox:

  1. Start the VM
  2. As soon as the VM starts, quickly press F2 (or Del)
  3. You enter the BIOS/UEFI

VMware:

  • Same, often F2 or Del

Questions:

  1. Which key allows access to your VM's BIOS?
  2. What is the current boot order?

Step 1.3: Change Boot Order​

In the BIOS/UEFI:

  1. Look for the Boot or Startup tab
  2. Find Boot Priority or Boot Order
  3. Change so that CD/DVD or USB is FIRST
  4. Save and Exit (usually F10)

Modified order:

  1. CD/DVD (or USB)
  2. Hard drive

Implication: The VM will now attempt to boot from the CD before the hard drive!

Part 2: Boot from Recovery ISO​

Step 2.1: Mount an ISO in the VM​

You will boot Windows from an ISO instead of the hard drive.

ISO Options:

Option A: Official Windows ISO

  • Download from Microsoft
  • Size: ~5 GB
  • 100% legal

Option B: Hiren's Boot CD (recommended for this lab)

  • Smaller
  • Contains admin tools
  • Legal and free

In VirtualBox:

  1. VM off
  2. Settings → Storage
  3. Under "IDE Controller", click the empty CD icon
  4. On the right, click the CD icon
  5. Choose a disk file
  6. Select your ISO
  7. OK

The ISO is now "inserted" into the virtual CD drive!

Step 2.2: Boot from the ISO​

Start the VM:

  1. The VM should boot from the ISO (since CD is prioritized)
  2. You will see the ISO screen (not the Windows login!)
  3. If it's Windows RE (Recovery Environment): Choose "Repair your computer"
  4. If it's Hiren's: You will see the Hiren's menu

You are now in a completely different system!

  • NOT Windows from the hard drive
  • A mini-OS running from the CD
  • BUT it can see the hard drive!

Questions: 3. Did you manage to boot from the ISO? 4. Which system did you boot (Windows RE, Hiren's, other)?

Step 2.3: Access Windows Files​

From Windows RE or Hiren's:

Open file explorer or a command prompt

If Command Prompt:

diskpart
list volume
exit

Identify the Windows volume (look for NTFS with ~20-30 GB)

Navigate to user files:

dir D:\Users
dir D:\Users\YourUsername\Documents
dir D:\Users\YourUsername\Desktop

BOOM! You see ALL the files!

Without knowing the password! Without even booting Windows!

Step 2.4: Copy Files​

You could now:

  1. Copy files to a USB key:
copy D:\Users\YourName\Documents\secret.docx E:\
  1. Modify files:
notepad D:\Users\YourName\file.txt
  1. Delete files:
del D:\Users\YourName\suspicious.exe

All this WITHOUT the Windows password!

Questions: 5. Were you able to see your Windows user files? 6. Were you able to copy a file? 7. How long did the entire operation take (from ISO insertion to file access)?

Part 3: Security Implications​

Step 3.1: Evil Maid Attack Scenario​

"Evil Maid Attack" = Attack with temporary physical access

Typical scenario:

  1. Victim leaves their laptop in hotel room (5 minutes)
  2. Attacker enters (accomplice maid, specialized agent)
  3. Boot from USB key (30 seconds)
  4. Copy sensitive files (2 minutes)
  5. OR install a bootkit/backdoor (1 minute)
  6. Normal reboot (30 seconds)
  7. Attacker leaves, victim returns

Total time: Less than 5 minutes! Victim: Notices NOTHING!

Compromised data:

  • Personal documents
  • Emails
  • Credentials saved by browser
  • SSH/GPG keys
  • History
  • EVERYTHING!

Questions: 8. Does this scenario seem realistic to you? 9. In what situations might you be vulnerable to this attack?

Step 3.2: Real Use Cases​

This technique is used by:

Government agents (legally):

  • NSA, FBI, CSIS
  • Search warrants
  • Criminal investigation

Criminals:

  • Theft of industrial secrets
  • Corporate espionage
  • Blackmail (access to personal data)

Yourself (legitimately):

  • Data recovery if password forgotten
  • File recovery on damaged disk
  • Authorized forensic investigation

Questions: 10. Can you think of other legitimate use cases? 11. How could a company protect itself?

Step 3.3: Demonstration - Simulated Data Theft​

Awareness exercise:

  1. Before the alternative boot, create a file on your VM:

    • C:\Users\YourName\Desktop\confidential.txt
    • Content: "This is an important secret"

  2. Boot from the ISO

  3. Locate and read the file:

type D:\Users\YourName\Desktop\confidential.txt
  1. Copy it "out of the machine":
copy D:\Users\YourName\Desktop\confidential.txt D:\stolen_data.txt

  1. Reboot normally (remove the ISO)

  2. Verify: The file stolen_data.txt now exists at the root of C:

You just simulated a data theft!

Questions: 12. Would you have noticed the intrusion on a real system? 13. Are there any logs of this access?

Part 4: Protection - Secure Boot​

Step 4.1: Understanding Secure Boot​

Secure Boot is a UEFI feature that:

  • Verifies the bootloader is digitally signed
  • Refuses to boot unsigned or modified OS
  • Protects against bootkits and rootkits

How it works:

  1. Microsoft (and others) have keys in the firmware
  2. Windows bootloaders are signed with these keys
  3. At boot, UEFI checks the signature
  4. If valid: boot allowed
  5. If invalid or absent: boot blocked!

Protection against:

  • Unauthorized USB boot
  • Bootkit
  • Boot-level rootkit
  • Modified OS

Step 4.2: Enable Secure Boot​

WARNING: Secure Boot requires Windows installed in UEFI mode (not Legacy BIOS)

In your VM's BIOS/UEFI:

  1. Restart and enter BIOS (F2)
  2. Look for Security or Boot
  3. Find Secure Boot
  4. Enabled
  5. Save and Exit

Test now:

  1. Try to boot from the recovery ISO
  2. Secure Boot should BLOCK the boot!
  3. Error message: "Secure Boot Violation"

You can no longer boot from the unsigned ISO!

Questions: 14. Did Secure Boot block the boot from the ISO? 15. Does normal Windows still start?

Step 4.3: Secure Boot Limitations​

Secure Boot protects against:

  • Unsigned USB/CD boot
  • Bootkit

Secure Boot DOES NOT PROTECT against:

  • File access if disk unencrypted AND Secure Boot disabled
  • Attacker disabling Secure Boot in BIOS (if no BIOS password!)
  • Hardware attacks (disk extraction)

For complete protection, you also need:

  • BIOS password
  • BitLocker (disk encryption)
  • Physical surveillance

Part 5: Protection - BIOS/UEFI Password​

Step 5.1: Types of BIOS Passwords​

3 types of passwords:

  1. Supervisor Password

    • Required to change BIOS settings
    • Required to disable Secure Boot
    • Most important!

  2. User Password

    • Required to BOOT the machine
    • Asked before even Windows!

  3. HDD Password

    • The disk itself is locked
    • Even if extracted, it's unusable

Step 5.2: Set a Supervisor Password​

In the BIOS:

  1. Enter BIOS (F2)
  2. Security → Set Supervisor Password
  3. Enter a password: AdminBIOS123!
  4. Confirm
  5. Save and Exit

Restart and re-enter BIOS:

  • Password required!
  • Without the password, settings cannot be changed!

Now, an attacker can no longer:

  • Change boot order
  • Disable Secure Boot
  • Modify security settings

Step 5.3: Set a Boot Password (Optional)​

WARNING: If you forget this password, the VM is UNUSABLE!

In BIOS:

  1. Security → Set User Password
  2. Password: BootPass123!
  3. Save and Exit

At next startup:

  • Password asked BEFORE Windows!
  • Without the password: machine won't start at all!

Protection:

  • Even with physical access, impossible to boot
  • Neither Windows, nor USB, nor anything!

Questions: 16. Did you set a supervisor password? 17. Test: Can you change the boot order without the password?

Part 6: Ultimate Protection - BitLocker​

Step 6.1: Why BitLocker is Crucial​

With Secure Boot + BIOS password:

  • Protection against alternative boot
  • Protection against settings modification

BUT: If an attacker extracts the hard drive:

  • They put it in THEIR computer
  • They boot from THEIR OS
  • They read all the files!
  • Secure Boot and BIOS password useless!

Solution: BitLocker (full disk encryption)

Step 6.2: Understanding BitLocker​

BitLocker encrypts the ENTIRE disk:

  • Impossible to read files without the key
  • Even when extracting the disk
  • Even when booting from USB

Decryption key stored in:

  • TPM (Trusted Platform Module) - chip on the motherboard
  • OR startup password
  • OR physical USB key

Without the key:

  • Files = incomprehensible gibberish
  • System = unusable

Step 6.3: Check BitLocker (Information)​

On your VM or real PC:

Method 1 - Explorer:

  1. Open Explorer
  2. Right-click on C:
  3. If you see a closed padlock = BitLocker active
  4. If open padlock = Not activated

Method 2 - PowerShell:

Get-BitLockerVolume

On most VMs: BitLocker not available (requires Windows Pro + virtual TPM)

Questions: 18. Is BitLocker enabled on your VM? 19. On your personal computer? 20. On your work/school computer?

Step 6.4: Enable BitLocker (If Available)​

If you have Windows Pro on VM:

  1. Control Panel → BitLocker
  2. Turn on BitLocker for C:
  3. Choose how to unlock:
    • Password
    • OR USB key
  4. Save the recovery key (CRUCIAL!)
  5. Choose: Encrypt entire disk or used space only
  6. Start encryption

Duration: 30 min - 2h depending on size

After activation:

  • At startup: Password asked (if option chosen)
  • Data encrypted in real-time
  • Slightly reduced performance (~5%)

Part 7: Defense in Depth​

Step 7.1: The 5 Layers of Protection​

Complete physical protection:

Layer 1: Physical surveillance
    ↓
Layer 2: BIOS password (prevents boot modification)
    ↓
Layer 3: Secure Boot (prevents unsigned boot)
    ↓
Layer 4: BitLocker (encrypts data)
    ↓
Layer 5: Windows password (authentication)

If ONE layer is missing:

  • Attacker can potentially bypass

With ALL layers:

  • Maximum protection
  • Even with physical access: data protected

Step 7.2: Protection Matrix​

AttackWithout protectionSecure BootBIOS PassBitLockerAll
USB Boot✅ Succeeds❌ Blocked❌ Blocked❌ Blocked❌ Blocked
Bypass password✅ Succeeds✅ Succeeds✅ Succeeds❌ Blocked❌ Blocked
Disk extraction✅ Readable✅ Readable✅ Readable❌ Encrypted❌ Encrypted
Evil Maid✅ Succeeds⚠️ Partial⚠️ Partial❌ Blocked❌ Blocked

For personal laptop:

  • ✅ Secure Boot enabled
  • ✅ BIOS supervisor password
  • ✅ BitLocker enabled
  • ✅ Auto-lock (1 minute)
  • ✅ Security cable (if in public place)

For enterprise server:

  • ✅ All of the above +
  • ✅ Locked rack
  • ✅ Video surveillance
  • ✅ Access badge to server room
  • ✅ Mandatory TPM
  • ✅ Physical intrusion detection

Questions: 21. How many layers of protection do you currently have on your VM? 22. How many on your personal computer?

Part 8: Practical Exercises​

Exercise 8.1: Physical Penetration Test​

Scenario: You are a security auditor. You are given 10 minutes of physical access to a VM.

Task:

  1. Document all data you can extract
  2. Measure time for each step
  3. Identify protections in place (or absent)

Deliverable: Audit report (2 pages)

Exercise 8.2: Hardened Configuration​

Task: Configure a VM with maximum protection:

  1. Secure Boot enabled
  2. BIOS password set
  3. BitLocker enabled (if possible)
  4. Boot order: HDD only
  5. USB boot disabled

Deliverable: Screenshots of each configuration

Exercise 8.3: Time Comparison​

Experiment:

VM A (Without protection):

  • Measure time to access a file via USB boot

VM B (Protected):

  • Secure Boot + BIOS Pass + Simulated BitLocker
  • Attempt the same attacks
  • Document blockages

Questions: 23. What is the time difference? 24. Which attacks are blocked by each protection?

Deliverables​

To submit:

  1. Answer document (Word/PDF):

    • Answers to the 24 questions
    • Measured time to access files
    • Analysis of attack scenarios

  2. Screenshots (minimum 6):

    • Boot from ISO (recovery menu)
    • Access to user files
    • Secure Boot configuration
    • BIOS password configuration
    • Boot attempt blocked by Secure Boot
    • BitLocker status

  3. Audit report (Exercise 8.1, 2 pages):

    • Methodology
    • Extracted data
    • Time required
    • Recommendations

  4. Completed protection matrix:

    • Your tested configurations
    • Results of each test

Evaluation Criteria​

CriterionPoints
Understanding of physical access attacks25%
Configuration of protections (Secure Boot, BIOS)25%
Analysis of Evil Maid scenarios20%
Audit report (Exercise 8.1)15%
Quality of documentation10%
Protection matrix5%

Quick Reference Commands​

File Navigation in Recovery Mode​

diskpart
list volume
exit
dir D:\Users
dir D:\Users\Username\Desktop
type D:\Users\Username\file.txt
copy D:\Users\Username\file.txt E:\

BitLocker Verification​

Get-BitLockerVolume
Get-BitLockerVolume -MountPoint C:

BIOS via Command Line (Info)​

# Check if Secure Boot is enabled
Confirm-SecureBootUEFI

# Firmware info
Get-ComputerInfo | Select-Object BiosFirmwareType

Troubleshooting​

Problem: ISO does not boot​

Solution:

  • Check that the ISO is properly mounted (Settings → Storage)
  • Check boot order (CD/DVD first)
  • If Secure Boot enabled: Temporarily disable

Problem: Unable to see files​

Solution:

  • Windows drive is likely not C: in recovery mode
  • Use diskpart → list volume to identify the correct volume
  • Often D: or E:

Problem: BIOS password forgotten​

VM Solution:

  • VirtualBox: Remove password via command line (see VirtualBox doc)
  • As a last resort: Recreate the VM from scratch

Physical (DIFFICULT):

  • Remove CMOS battery (resets BIOS)
  • BIOS reset jumper
  • Or contact manufacturer

Going Further (Optional)​

Challenge 1: Hardware Attack​

Research "Cold Boot Attack" - recovery of encryption keys via RAM freezing.

Document:

  • How it works
  • Countermeasures
  • Effectiveness against BitLocker

Challenge 2: Forensics​

Boot with a forensic distribution (CAINE, DEFT) and:

  • Create a disk image
  • Analyze artifacts
  • Recover deleted files
  • Document the chain of custody

Challenge 3: TPM and Attestation​

If your VM supports TPM:

  • Configure virtual TPM
  • Enable BitLocker with TPM
  • Test attestation
  • Document the difference with simple password

Additional Resources​

Conclusion​

This lab taught you:

  • How to access files without a password via alternative boot
  • Evil Maid attacks and their impact
  • Secure Boot configuration
  • BIOS password protection
  • The importance of BitLocker

Key lessons:

  1. Physical access = Full access (without encryption)
  2. Alternative boot bypasses Windows completely
  3. Secure Boot blocks unauthorized boot
  4. BIOS password prevents settings modification
  5. BitLocker = Only true protection against data extraction
  6. Defense in depth = Multiple layers of security

Final message:

  • On laptops: BitLocker MANDATORY
  • On servers: Physical security CRITICAL
  • Never leave machine unattended
  • Auto-lock after 1 minute

You now know why physical security is as important as software security!

Lab developed as part of the Operating Systems course - MODULE 2