[rocqua]

Really, that should not be possible with secure boot. Secure boot ensures only trusted OSes are run, and those OSes should require authorization before allowing secure boot to be turned off. Scarier evil maid attacks involve changing hardware or firmware. The personalized version of secure boot mentioned would make that more difficult.

Incidentally, an interesting defense against evil maid attacks involves glitter nail polish. Use it on a sticker over the case and take a photo. To verify your laptop is safe, compare the sticker with the photo. The key is that glitter polish has a lot of minute detail and is thus hard to replicate.

This only gives tamper protection, but evil maid attacks require interaction so it suffices for security.