8 ms·

> as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamp

> as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag You didn’t specify what type of anti-tamper was used, but I wanted to jump in and say usually that means nothing. The US government intercepted packages [0] and put in back doors (removing and replacing the seals), so I’m not sure why you were so quick to dismiss state sponsored attacks by something as simple as an anti-tamper seal. You can learn how to do it yourself at most medium to large hacker conferences too (DEFCON, BlackHat, HOPE, and CCC to name a few, but there’s more with it). [0] https://www.techradar.com/news/networking/routers-storage/photos-reveal-nsa-tampered-with-cisco-router-prior-to-export-1249191 https://www.techradar.com/news/networking/routers-storage/ph...

folli 8y ago
The chinese government is probably not interested enough in credit card numbers to warrant involvement.
- lmilcin 8y ago
  It would be foolish to show your hand for few pennies.
  - jandrese 8y ago
    Might make a difference if those pennies can't be tracked back to the government.
    - malandrew 8y ago
      Yup. This would be the modern equivalent of Air America and other schemes by the CIA to raise money to operate by involving themselves in illegal activity like the drug trade.
      - jessaustin 8y ago
        One would consider those activities to have taken place in "modern" times as well...
      - acct1771 8y ago
        You're not suggesting the CIA is out of the drug business...are you?
        jandrese 8y ago
        Iran/Contra got the CIA into a lot of hot water with Congress. They had some pretty stringent restrictions put in place as a result. https://www.csmonitor.com/1987/1113/aintel.html https://www.csmonitor.com/1987/1113/aintel.html
- Nasrudith 8y ago
  People said the same thing about personal detail metadata as well. While theft would be foregone foolishness tracking transactions could have value to them. Granted it would probably be easier to snoop on the fiscal institutions.
moftz 8y ago
You can just buy counterfeit anti-tamper stickers but if there is a switch inside the unit that flips a bit in some sort of write-once memory, then that would require removal of an entire chip and replacing it with another that may not be 100% the same. You can have a chain of trust in the system where chips will only talk to each other if they all spit out the right hash. Bury the SPI/I2C lines you use for this trust check within the PCB so you can't access it without drilling the card and add a layer of anti-tamper traces that trigger another tamper event if disturbed. Now what was just a quick install has turned into a whole PCB rework job where you are having to swap all the chips with a virgin set, assuming you can't get your hardware in there prior to final assembly. Use an AES256 key from the factory to hash the chip's burned-in serial number and the time from the RTC. Lock out JTAG interfaces so once the chips are burned, they are inside their own fortress. There are a ton of ways to really lock down the hardware other than a shiny sticker and weird screws. Those keep people from breaking their own hardware, anti-tamper tech in chips keep out bad guys.
- lmilcin 8y ago
  The device outer enclosure was tamper evident but the device itself was tamper proof HSM, basically. Any kind of intrusion (melting, dissolving, drilling, etc.) into a secure internal enclosure (separate processor, memory and battery) would cause internal battery to be disconnected from internal SRAM and basically the device would loose all cryptographic material and then self-destruct. To give a bit of background, when you type your PIN on credit card terminal it is not the terminal application that is really getting the pin (well, except for special credit cards but that is really problem of the Bank that issued the card). The Visa/Mastercard mandate that the application don't have control over the PIN and that the PIN entry uses physically separate keyboard and display. To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry and the PIN is transferred directly to the HSM where it is being encrypted before it is transferred to the application processor for the rest of processing.
  - caf 8y ago
    Those VISA/MasterCard rules can't be universal because there's at least one bank issuing merchant terminals that run Android and take the PIN on the touchscreen: https://www.commbank.com.au/business/merchant-services/eftpos-terminals/albert.html https://www.commbank.com.au/business/merchant-services/eftpo...
wepple 8y ago
Payment systems are typically better defended than by just a sticker. It’s not surprising to see a ton of tamper switches, vibration/shock sensors, even light sensors. And they’re all powered by an internal batter and separate MCU that will brick the device upon open.
- jsjohnst 8y ago
  All of which are overcome by nation state actors if they want too.
  - koffiezet 8y ago
    Depends on the hardware and the anti-tamper measures. I've seen POS terminals where the pcb was completely encased in security plastic, where any attempted breach would wipe the internal security keys, which meant the hardware just became a useless. They're so sensitive that these things enter "tampered state" from time to time without any tampering. I developed software on these things - and bricked multiple devices by accident, even though this was 'development' hardware.
    - lmilcin 8y ago
      I have caused production outage during one of our reviews of the rack with the HSM. The procedure required opening the rack, inspecting and accounting for all devices and cables and then checking the status of the HSM itself. At the end of the procedure the rack had to be closed. Visa/Mastercard required that there are two people present and that there are two people required to open the rack. We had it modified so that it has second lock. The additional lock did not fit perfectly. During the procedure when I tried to close the door the door snagged on the lock and then slammed shut. It wasn't a lot of force but it caused the HSM to loose its keys and required a lengthy procedure to get three security officers to initialize the HSM with components stored on their smart cards during which the whole system was unavailable.
tfha 8y ago
What's the motive? If we assume a motive of theft, seems more reasonable that there's organized crime involved than a state actor.
paulmd 8y ago
> something as simple as an anti-tamper seal To echo, it's actually quite trivial to bypass anti-tamper stickers with acetone and a needle. https://www.youtube.com/watch?v=SqkMIek8sqI https://www.youtube.com/watch?v=SqkMIek8sqI

folli 8y ago

The chinese government is probably not interested enough in credit card numbers to warrant involvement.

lmilcin 8y ago
It would be foolish to show your hand for few pennies.
- jandrese 8y ago
  Might make a difference if those pennies can't be tracked back to the government.
  - malandrew 8y ago
    Yup. This would be the modern equivalent of Air America and other schemes by the CIA to raise money to operate by involving themselves in illegal activity like the drug trade.
    - jessaustin 8y ago
      One would consider those activities to have taken place in "modern" times as well...
    - acct1771 8y ago
      You're not suggesting the CIA is out of the drug business...are you?
      - jandrese 8y ago
        Iran/Contra got the CIA into a lot of hot water with Congress. They had some pretty stringent restrictions put in place as a result. https://www.csmonitor.com/1987/1113/aintel.html https://www.csmonitor.com/1987/1113/aintel.html
Nasrudith 8y ago
People said the same thing about personal detail metadata as well. While theft would be foregone foolishness tracking transactions could have value to them. Granted it would probably be easier to snoop on the fiscal institutions.

moftz 8y ago

You can just buy counterfeit anti-tamper stickers but if there is a switch inside the unit that flips a bit in some sort of write-once memory, then that would require removal of an entire chip and replacing it with another that may not be 100% the same. You can have a chain of trust in the system where chips will only talk to each other if they all spit out the right hash. Bury the SPI/I2C lines you use for this trust check within the PCB so you can't access it without drilling the card and add a layer of anti-tamper traces that trigger another tamper event if disturbed. Now what was just a quick install has turned into a whole PCB rework job where you are having to swap all the chips with a virgin set, assuming you can't get your hardware in there prior to final assembly. Use an AES256 key from the factory to hash the chip's burned-in serial number and the time from the RTC. Lock out JTAG interfaces so once the chips are burned, they are inside their own fortress. There are a ton of ways to really lock down the hardware other than a shiny sticker and weird screws. Those keep people from breaking their own hardware, anti-tamper tech in chips keep out bad guys.

lmilcin 8y ago
The device outer enclosure was tamper evident but the device itself was tamper proof HSM, basically. Any kind of intrusion (melting, dissolving, drilling, etc.) into a secure internal enclosure (separate processor, memory and battery) would cause internal battery to be disconnected from internal SRAM and basically the device would loose all cryptographic material and then self-destruct. To give a bit of background, when you type your PIN on credit card terminal it is not the terminal application that is really getting the pin (well, except for special credit cards but that is really problem of the Bank that issued the card). The Visa/Mastercard mandate that the application don't have control over the PIN and that the PIN entry uses physically separate keyboard and display. To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry and the PIN is transferred directly to the HSM where it is being encrypted before it is transferred to the application processor for the rest of processing.
- caf 8y ago
  Those VISA/MasterCard rules can't be universal because there's at least one bank issuing merchant terminals that run Android and take the PIN on the touchscreen: https://www.commbank.com.au/business/merchant-services/eftpos-terminals/albert.html https://www.commbank.com.au/business/merchant-services/eftpo...

wepple 8y ago

Payment systems are typically better defended than by just a sticker. It’s not surprising to see a ton of tamper switches, vibration/shock sensors, even light sensors. And they’re all powered by an internal batter and separate MCU that will brick the device upon open.

jsjohnst 8y ago
All of which are overcome by nation state actors if they want too.
- koffiezet 8y ago
  Depends on the hardware and the anti-tamper measures. I've seen POS terminals where the pcb was completely encased in security plastic, where any attempted breach would wipe the internal security keys, which meant the hardware just became a useless. They're so sensitive that these things enter "tampered state" from time to time without any tampering. I developed software on these things - and bricked multiple devices by accident, even though this was 'development' hardware.
  - lmilcin 8y ago
    I have caused production outage during one of our reviews of the rack with the HSM. The procedure required opening the rack, inspecting and accounting for all devices and cables and then checking the status of the HSM itself. At the end of the procedure the rack had to be closed. Visa/Mastercard required that there are two people present and that there are two people required to open the rack. We had it modified so that it has second lock. The additional lock did not fit perfectly. During the procedure when I tried to close the door the door snagged on the lock and then slammed shut. It wasn't a lot of force but it caused the HSM to loose its keys and required a lengthy procedure to get three security officers to initialize the HSM with components stored on their smart cards during which the whole system was unavailable.

tfha 8y ago

What's the motive? If we assume a motive of theft, seems more reasonable that there's organized crime involved than a state actor.

paulmd 8y ago

> something as simple as an anti-tamper seal To echo, it's actually quite trivial to bypass anti-tamper stickers with acetone and a needle. https://www.youtube.com/watch?v=SqkMIek8sqI https://www.youtube.com/watch?v=SqkMIek8sqI