Do Not Disturb (macOS)

One of the best ways to compromise a computer is with physical access. Many of us have likely left our laptops unattended (perhaps in a hotel room while traveling?). It'd be nice to know if somebody attempted to hack it! ya?

Do Not Disturb (DND) continually monitors your system for events that may indicate a precursor of "evil maid" attack. Specifically it watches for 'lid open' events (idea credit: @thegrugq).

If you've shut your laptop (and thus triggered sleep mode), the majority of physical access attacks may require the lid to be opened in order for the attack to succeed. Such attacks could include:

• Logging in locally as root, by exploiting a bug such as '#iamroot'
• Locally logging in via credentials captured by a hidden camera
• Inserting a malicious device into a USB or Thunderbolt port.

Again, most of these attacks require a closed laptop to be opened...either to awake it (i.e. to process a malicious device) or for the attacker to interact with the laptop!