7 ms·
Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack w
by captainmuon 6y ago
Interesting project, I'm sure this is useful for people at risk.
Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys.
All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody here set up a chassis intrusion kill switch that erases the RAM/shuts down the PC etc. if the case is opened improperly? Can you buy anything like this on the market?
- deleted 6y ago[deleted]
- alfiedotwtf 6y agoBack in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)
- luckylion 6y agoSome ideas have been tested, there was an entertaining talk a few years back at DefCon: https://www.youtube.com/watch?v=-bpX8YvNg6Y https://www.youtube.com/watch?v=-bpX8YvNg6Y
- geerlingguy 6y agoI would imagine that's thermite and not termite ;) If the latter, the server would probably be okay, and it would take a very long time for the termites to damage the surrounding room enough to be a security deterrent.
- DoofusOfDeath 6y agoProbably just a debugging technique.
- Teknoman117 6y agoor a bugging technique?
- hinkley 6y agoWell, it certainly complicates debugging.
- kibwen 6y agoNah, it's termite. You're trying to destroy your logs, right?
- alfiedotwtf 6y agoHa! Very nice :)
- alfiedotwtf 6y agoSorry that was a typo. Haha!
- Fjolsvith 6y agoThis was a plot device used in the TV series Mr. Robot Season 2, Episode 3, about 27 minutes in.
- Nasrudith 6y agoI think in most cases the thermite trap would probably get you into more trouble for ATF violations and not even help by adding destruction of evidence and whatever they imagined was on the drive unless you had some authority like security clearence and classified documents or some sort of legal pretext to justify uses of such flammable boobytraps.
- codezero 6y agoIt's funny when I think back, I was a teen in the 90s and did plenty of questionable stuff online and w/ local BBS scene (Kevin Mitnick was busted in Raleigh and many rumors existed about his presence in the BBS scene, obviously fantasy though!). Nobody I know who got arrested ever managed to destroy anything. When I think about it, we all assumed the cops would storm in when we were in the act of doing something bad, probably like in the movies lol, when in practice, they tend to pick you up when you are really off guard, duh. Very few people had automatic protections because like, our parents would probably get mad if we burned down the house :) When it came to me, the FBI did knock on my front door, and I managed to dd if=/dev/random of=/dev/hda I lost my entire BBS, all the custom code and ANSI I had for it, among other ancient treasures that I'd probably still have with my napster mp3s :) Of course they didn't come for me, there had been a flasher in the neighborhood on halloween...
- jandrese 6y agoThe FBI was investigating a flasher?
- codezero 6y agoI could be remembering incorrectly, but it may have been reoccurring or not even really the FBI, but state police or something and my parents said it was the FBI. I only saw people in suits with a black car outside knocking on the door, also this was like 30 years ago so don't twist my arm :)
- rasz 6y agoThis is how you earn tampering with evidence charges, up to 20 years felony.
- eertami 6y agoSurely it has to be actual evidence before you "tamper" with it. If I delete a file on my computer today that would be potentially "evidence" if seized, and the police come knocking tomorrow, I haven't committed a crime by using my personal computer in the past.
- rasz 6y agoDEF CON 23 - Zoz - And That's How I Lost My Other Eye...Explorations in Data Destruction https://www.youtube.com/watch?v=-bpX8YvNg6Y https://www.youtube.com/watch?v=-bpX8YvNg6Y
- Mandatum 6y agoHacking with Ramzy.. 14 years old now! https://www.youtube.com/watch?v=-hNQ280Zkk4 https://www.youtube.com/watch?v=-hNQ280Zkk4
- Asmod4n 6y agoChenbro makes cases with intrusion detection, bought one nearly 20 years ago and they still make similar ones: http://www.chenbro.com/en-global/products/TowerServerChassis/Mini_ITX_Server/SR301_PLUS http://www.chenbro.com/en-global/products/TowerServerChassis...
- macNchz 6y agoI have a Lenovo M93P Tiny which came with a chassis intrusion switch installed. It seems you can have it block startup/require a password when the case is opened and notify some central admin. I don’t know what happens if you open the case while it’s running, though. I’m not sure if it’s something they offer on current models, or to individuals at all (I bought it used from a corporate IT asset liquidator so it was likely originally purchased as part of a bulk deal). Regardless it makes a great little Linux box!
- destory-everyth 6y agoWork at a big bank , we won’t procure laptops without this and yes we will know when you have opened it and you won’t be able to boot it , I think something happens with bitlocker also but not sure.
- Nextgrid 6y agoCould you give examples of laptops with this feature? I never knew chassis intrusion sensors were a thing on laptops. Also, does it still work if you open the machine with the power disconnected and battery removed?
- sammex 6y agoI'm pretty sure most thinkpads have case intrustion detection. It's callled "Bottom Cover Tamper Access Detection" in BIOS.
- R0b0t1 6y agoThat feature is fairly common but practically quite useless and easy to circumvent if you can find the model information. Even with PCI-DSS enclosure compliance you can get in if you can take power tools to it. The assumption is power tools would be too obvious to use in a typical installation.
- umvi 6y ago> Interesting project, I'm sure this is useful for people at risk. Could you expound on what this means? In the USA/UK, people most "at risk" of police kicking down the door seizing their laptops/computers while they are still running are child pornographers. Perhaps this can be used "for good" under oppressive regimes (i.e. if you are a dissenting journalist) but then I think you won't get a fair trial anyway and having a kill switch just means more prison.
- toxik 6y agoThis is a somewhat pessimistic outlook on humanity, first off I would say that those who are most commonly at risk are those with trade secrets. Patented tech and investment intel for example. As for the dissenters, I’m sure they would appreciate their co-conspirators remain secret.
- umvi 6y ago> This is a somewhat pessimistic outlook on humanity, first off I would say that those who are most commonly at risk are those with trade secrets. Patented tech and investment intel for example. Can you provide any evidence at all of police or "thugs" (or anyone, really) kicking down doors to get at trade secrets being a common problem? Because there are countless news articles of police raids seizing computers to stop child porn[0]. I speculate any tool billed as "anti-forensic" will be used for immoral purposes more commonly than moral purposes. [0] https://en.wikipedia.org/wiki/Jared_Fogle#Child_pornography_investigation_and_arrest https://en.wikipedia.org/wiki/Jared_Fogle#Child_pornography_...
- Teknoman117 6y agoIt is an absolute certainty that any tool to improve privacy and security is going to be used by malicious actors. That does not mean it should be banned. Knives are used for many things from cutting food and opening boxes to killing people. Nitrate based fertilizers can be used for vastly improving crop yields but can also be used for bombs. Encryption can be used to protect your sensitive personal data from criminals and prying eyes, but can also be used by the criminals themselves to hide their activities. No state (even if it was the most ethically illuminated utopia) has the power to protect every person in every place at every time. Banning defensive tools is asinine as rarely does it mean that a criminal won't use them against you.
- osivertsson 6y agoI doubt there is a need to open the case for a sophisticated attacker. If there is even the slightest opening for air you can run camera optics and freeze spray tubes to RAM I would imagine.
- NovemberWhiskey 6y agoThis is why security-sensitive devices are often encapsulated and potted in epoxy or similar.
- seanhunter 6y agoHere's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/ https://citp.princeton.edu/our-work/memory/ If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal. //Small edit to wording
- claudiawerner 6y agoDoes anyone have pointers as to whether this is even possible with DDR4 on modern machines?
- aaron695 6y agoI think the real question is has it ever been used in the wild on any DDR? "In recent years, however, it has become increasingly challenging to execute cold boot attacks or perform physical memory forensics due to the introduction of DRAM memory scramblers. Modern processors with DDR3 and DDR4 DRAM scramble data by XOR’ing it with a pseudorandom number before writing it to DRAM [5], [6]. These scramblers were initially introduced to mitigate the effects excessive current fluctuations on bus lines by ensuring bits on the memory bus transition nearly 50% of the time" DDR4 is also yes in the lab - https://web.eecs.umich.edu/~misiker/resources/HPCA17-coldboot.pdf https://web.eecs.umich.edu/~misiker/resources/HPCA17-coldboo...
- close04 6y agoMany of the measures that provide effective physical security also make a device really unsuited for personal usage. Look at HSMs for an example of this. And even they rely on being stored in a physically secure room and protected from theft. It's a matter of being more determined than your attacker. Imagine a device that will irretrievably brick itself if tilted more than a certain angle, if left unpowered for more than a certain time, etc. and that has to be under constant guard. This seems almost incompatible with any kind of personal use. And some measures may only work in one instance, with the attacker planning for them the second time they have an operation. Many attackers also don't have the same restrictions the police has. In the Ulbricht case the police may have been forced to use a device that copies the data with no human intervention just to preserve the chain of evidence and not have suspicions that the agent operating the laptop altered it while installing additional software. An attacker operating in the grey/dark area might just immobilize the user, snip the wrist cable, and then retrieve the necessary data either directly at the console or by siphoning it via the network. Or the police may just start video recording in great detail every step from the moment an agent touched the laptop until the data was exfiltrated to remove suspicions of tampering. But such a tool would be of great effect against an undetermined, unsophisticated attacker committing a crime of opportunity.
- _kbh_ 6y agoMemory encryption technologies such as AMD's Secure Encrypted Memory (SME). Would be your best bet to combat this, along with other anti-evil maid protections. https://en.wikichip.org/wiki/x86/sme#Overview https://en.wikichip.org/wiki/x86/sme#Overview https://www.qubes-os.org/doc/anti-evil-maid/ https://www.qubes-os.org/doc/anti-evil-maid/
- captainmuon 6y agoThere are also things like TRESOR [1] which keep all encryption keys inside the CPU. I'm not sure what the current state of the art is. There are so many possible evil maid attacks that I think it would be useful to add a pysical layer, just in case. [1] https://en.wikipedia.org/wiki/TRESOR https://en.wikipedia.org/wiki/TRESOR
- _kbh_ 6y agoTRESOR is a great project but pretty seperate to SME imo. TESOR implements SME but its implemented effectively in software, making it less secure and a lot slower. The great thing about SME on AMD CPUs is that I believe (at least on the newer Zen cores) it effectively can run at the speed of the memory, so you have no performance loss.
- stjohnswarts 6y agoI think SEV is newer form of this.
- _kbh_ 6y agoSecure Encrypted Virtualisation uses SEM, but it is not a newer version of it. SEV allows someone to run encrypted VMs that not even the host can read the memory, by leveraging per VMs keys in the AMD PSP that encrypt the VMs pages using SEM. It would be interesting to leverage SEM to run a version of qubes where not only are the VMs isolated by the Xen hypervisor but are also separately encrypted using the PSP.
- deleted 6y ago[deleted]
- fortran77 6y agoAgreed; but this USBKill is a good protection for ordinary city police, or even a grab-and-run crime at a coffeeshop (with a usb key attached to your wrist with a cord).
- asimpletune 6y agoTouch Bar MBP's are protected against this right?