4 ms·

If nothing else, would let you move a Frogger machine. More seriously, I have wondered if you can detect these kinds of external interference. Auto lock the ma

If nothing else, would let you move a Frogger machine. More seriously, I have wondered if you can detect these kinds of external interference. Auto lock the machine if power/network/wifi/Bluetooth/USB conditions change. Nabbing an unlocked laptop was how they got the Silk Road guy (though they probably already had sufficient evidence elsewhere). https://arstechnica.com/tech-policy/2015/05/sunk-how-ross-ulbricht-ended-up-in-prison-for-life/ https://arstechnica.com/tech-policy/2015/05/sunk-how-ross-ul...

akira2501 2y ago
> detect these kinds of external interference. Easily. Bolt the machine to the floor in such a way where the case has to be opened and a trip sensor activated to actually move the machine. You can switch my power source without noticing? Who cares. The attack is taking the machine where it is not supposed to be. That's a problem we've been solving since forever.
MertsA 2y ago
Wifi would probably be the easiest. Either hide a dummy AP in the house or use a combination of multiple neighbors APs. If you don't see any beacon frames from the dummy SSID for a 30 second period then lock/shred the computer.
- justsomehnguy 2y ago
  Wifi 5/6 sometimes rake up to a couple of minutes to get online (DFS and whatever) so 30 seconds is like smoking near an open can of gasoline: mostly fine but when it's not...
amluto 2y ago
Maybe attack the problem from a different angle: use an accelerometer. Or spend a little bit more money to add a gyro and make a real, if very low accuracy, IMU.
- adgjlsfhk1 2y ago
  Seems like an mems accelerometer would be all you need. Rotation isn't really a threat...
  - amluto 2y ago
    Rotation itself isn’t a threat, but if you want to directly estimate displacement to distinguish between earthquakes and someone stealing the machine, without relying on heuristics, actual inertial measurement would do the trick. And inertial measurement involves tracking the direction of acceleration, which involves tracking rotation.
- 0cf8612b2e1e 2y ago
  That is a great suggestion. I think Android just implemented a “snatch detection” system for phones. Although, I like the idea of not requiring additional hardware. I guess when I start running a drug empire I will have to pony up for the extra dongle.
- TeeMassive 2y ago
  That's a great idea. Authorizing any kind of physical change should be a default security measures.
- TimeBearingDown 2y ago
  BusKill was created for this, USB with a magnetic attachment to a keyring that can be configured to take action on disconnect.
- mcpherrinm 2y ago
  Some HSMs I've used (payshields) have tamper sensors that can detect motion for this reason. > The ADXL362 accelerometer in the PayShield 10K acts as a "Motion Sensor" detecting tilt movements. An alarm triggers an alert if the HSM is moved (for example, slid out of the rack)
jeroenhd 2y ago
One trick you could use is to abuse the fact that law enforcement often plugs in a mouse wiggler on an unlocked desktop and kill your server the moment you see a new HID device (make sure to run some kind of desktop on your server so they think they can keep the session open, best to do it in a VM). You could also monitor the ethernet link. They can move your server but they can't move the entire network, set up an encrypted tunnel between two distant physical servers and self destruct the moment that tunnel gets disrupted. Some computers come with gyros/accelerometers built in. My old HP laptop had some kind of head crash prevention that used that hardware. I know this, because Gnome thought it was a tablet style sensor and turned my screen upside down if I didn't disable the sensor. Maybe getting a HP server can already get you a whole bunch of movement sensors. You could probably figure out if the server is being moved by measuring capacitance of the case, measuring accelerometers, maybe add a GPS dongle. Or you could add an LTE connector and measure any signals you may receive that you shouldn't from inside a server room. You can probably measure _something_ in the server room, though, so to make sure your LTE dongle doesn't get interrupted, also measure whatever reliable signal you can find to detect Faraday cages. Lastly, you could put a video camera in the case on all sides and measure changes. Detecting law enforcement badges probably isn't that hard with opencv if you're dedicated enough. You have to hide your security measures and never tell anyone, though, or they'll just leave the server as-is and use the classic rubber hose exploit to make you give up the key material.
- tbrownaw 2y ago
  > Or you could add an LTE connector and measure any signals you may receive that you shouldn't from inside a server room. Incoming Bluetooth Low Energy announcements should have a receive power level associated with them. Stick a beacon (like say a standard ble temperature/humidity sensor) somewhere, and you should be able to tell if the distance to it changes.
- Onavo 2y ago
  [flagged]
- gosub100 2y ago
  https://github.com/defuse/swatd https://github.com/defuse/swatd
dullcrisp 2y ago
If they’re seizing your laptop and your laptop will only work inside your house, wouldn’t they just seize your whole house?
- lobsterthief 2y ago
  They absolutely would
- 0cf8612b2e1e 2y ago
  It is a secret one way lock. Disturbing the machine and it locks/encrypts/sheds data. Bringing the machine back to the safe zone would not decrypt the data.

akira2501 2y ago

> detect these kinds of external interference. Easily. Bolt the machine to the floor in such a way where the case has to be opened and a trip sensor activated to actually move the machine. You can switch my power source without noticing? Who cares. The attack is taking the machine where it is not supposed to be. That's a problem we've been solving since forever.

MertsA 2y ago

Wifi would probably be the easiest. Either hide a dummy AP in the house or use a combination of multiple neighbors APs. If you don't see any beacon frames from the dummy SSID for a 30 second period then lock/shred the computer.

justsomehnguy 2y ago
Wifi 5/6 sometimes rake up to a couple of minutes to get online (DFS and whatever) so 30 seconds is like smoking near an open can of gasoline: mostly fine but when it's not...

amluto 2y ago

Maybe attack the problem from a different angle: use an accelerometer. Or spend a little bit more money to add a gyro and make a real, if very low accuracy, IMU.

adgjlsfhk1 2y ago
Seems like an mems accelerometer would be all you need. Rotation isn't really a threat...
- amluto 2y ago
  Rotation itself isn’t a threat, but if you want to directly estimate displacement to distinguish between earthquakes and someone stealing the machine, without relying on heuristics, actual inertial measurement would do the trick. And inertial measurement involves tracking the direction of acceleration, which involves tracking rotation.
0cf8612b2e1e 2y ago
That is a great suggestion. I think Android just implemented a “snatch detection” system for phones. Although, I like the idea of not requiring additional hardware. I guess when I start running a drug empire I will have to pony up for the extra dongle.
TeeMassive 2y ago
That's a great idea. Authorizing any kind of physical change should be a default security measures.
TimeBearingDown 2y ago
BusKill was created for this, USB with a magnetic attachment to a keyring that can be configured to take action on disconnect.
mcpherrinm 2y ago
Some HSMs I've used (payshields) have tamper sensors that can detect motion for this reason. > The ADXL362 accelerometer in the PayShield 10K acts as a "Motion Sensor" detecting tilt movements. An alarm triggers an alert if the HSM is moved (for example, slid out of the rack)

jeroenhd 2y ago

One trick you could use is to abuse the fact that law enforcement often plugs in a mouse wiggler on an unlocked desktop and kill your server the moment you see a new HID device (make sure to run some kind of desktop on your server so they think they can keep the session open, best to do it in a VM). You could also monitor the ethernet link. They can move your server but they can't move the entire network, set up an encrypted tunnel between two distant physical servers and self destruct the moment that tunnel gets disrupted. Some computers come with gyros/accelerometers built in. My old HP laptop had some kind of head crash prevention that used that hardware. I know this, because Gnome thought it was a tablet style sensor and turned my screen upside down if I didn't disable the sensor. Maybe getting a HP server can already get you a whole bunch of movement sensors. You could probably figure out if the server is being moved by measuring capacitance of the case, measuring accelerometers, maybe add a GPS dongle. Or you could add an LTE connector and measure any signals you may receive that you shouldn't from inside a server room. You can probably measure _something_ in the server room, though, so to make sure your LTE dongle doesn't get interrupted, also measure whatever reliable signal you can find to detect Faraday cages. Lastly, you could put a video camera in the case on all sides and measure changes. Detecting law enforcement badges probably isn't that hard with opencv if you're dedicated enough. You have to hide your security measures and never tell anyone, though, or they'll just leave the server as-is and use the classic rubber hose exploit to make you give up the key material.

tbrownaw 2y ago
> Or you could add an LTE connector and measure any signals you may receive that you shouldn't from inside a server room. Incoming Bluetooth Low Energy announcements should have a receive power level associated with them. Stick a beacon (like say a standard ble temperature/humidity sensor) somewhere, and you should be able to tell if the distance to it changes.
Onavo 2y ago
[flagged]
gosub100 2y ago
https://github.com/defuse/swatd https://github.com/defuse/swatd

dullcrisp 2y ago

If they’re seizing your laptop and your laptop will only work inside your house, wouldn’t they just seize your whole house?

lobsterthief 2y ago
They absolutely would
0cf8612b2e1e 2y ago
It is a secret one way lock. Disturbing the machine and it locks/encrypts/sheds data. Bringing the machine back to the safe zone would not decrypt the data.