4 ms·

I opened up the RSA SecureID token I had years ago. It had a glue poured inside until the whole thing was basically solid. I spent hours trying to pull bits off

I opened up the RSA SecureID token I had years ago. It had a glue poured inside until the whole thing was basically solid. I spent hours trying to pull bits off it and ended up snapping the board. It's overly surprisingly to me something so simple didn't seem to be a feature in these devices.

Scoundreller 8y ago
That works against you. With the hollow devices, you can weigh it to see if there’s a difference. If it’s full of glue, remove glue, add your implant and add enough counterweight so it weighs the same as the stock device.
- technion 8y ago
  Interesting trade off. I can't see many people in practice weighing a device. I could see a casual hacker physically destroying a device putting such an implant in. But not every attacker or victim are in the common category. Of course, getting there earlier in the supply chain..
  - Scoundreller 8y ago
    Should be par for the course for individuals putting their life savings on such a thing. A kitchen scale gives you .1g accuracy, which should be enough to tell you something is off. I've heard the same for fake IDs: clubs will weigh them to see if their weight is within range of real IDs.
- pjc50 8y ago
  > remove glue It's supposed to be "potting compound", which is a form of epoxy, and if the right one is chosen it's very hard to get it off with anything short of fuming nitric acid. Combined with the microwires trick it can be made extremely difficult to get at the PCB without triggering the tamper detection. See FIPS 140: https://webcache.googleusercontent.com/search?q=cache:HERKv5MloV0J:https://csrc.nist.gov/CSRC/media/Presentations/FIPS-140-3-Section-5-Physical-Security/images-media/physecpre18.pdf+&cd=1&hl=en&ct=clnk&gl=uk&client=firefox-b-ab https://webcache.googleusercontent.com/search?q=cache:HERKv5... (google cache version because the US has decided to be a failed state for a few weeks again)
  - technion 8y ago
    Thanks for that info. These devices are FIPS certified so I'd expect you've explained exactly what it was.

Scoundreller 8y ago

That works against you. With the hollow devices, you can weigh it to see if there’s a difference. If it’s full of glue, remove glue, add your implant and add enough counterweight so it weighs the same as the stock device.

technion 8y ago
Interesting trade off. I can't see many people in practice weighing a device. I could see a casual hacker physically destroying a device putting such an implant in. But not every attacker or victim are in the common category. Of course, getting there earlier in the supply chain..
- Scoundreller 8y ago
  Should be par for the course for individuals putting their life savings on such a thing. A kitchen scale gives you .1g accuracy, which should be enough to tell you something is off. I've heard the same for fake IDs: clubs will weigh them to see if their weight is within range of real IDs.
pjc50 8y ago
> remove glue It's supposed to be "potting compound", which is a form of epoxy, and if the right one is chosen it's very hard to get it off with anything short of fuming nitric acid. Combined with the microwires trick it can be made extremely difficult to get at the PCB without triggering the tamper detection. See FIPS 140: https://webcache.googleusercontent.com/search?q=cache:HERKv5MloV0J:https://csrc.nist.gov/CSRC/media/Presentations/FIPS-140-3-Section-5-Physical-Security/images-media/physecpre18.pdf+&cd=1&hl=en&ct=clnk&gl=uk&client=firefox-b-ab https://webcache.googleusercontent.com/search?q=cache:HERKv5... (google cache version because the US has decided to be a failed state for a few weeks again)
- technion 8y ago
  Thanks for that info. These devices are FIPS certified so I'd expect you've explained exactly what it was.