18 ms·
Don't want your laptop tampered with? Just add glitter nail polish
- randall 13y agoClever!
- nicolethenerd 13y agoMisleading title - this doesn't prevent tampering, it just makes it obvious to you, as the laptop owner, that your machine has been tampered with. Still useful, but then what are you supposed to do about it?
- deletes 13y agoYou are informed that the machine is not to be trusted. From then on proceed depending on how secure your data is.
- huhtenberg 13y agoIt may actually prevent tampering if the tampering is supposed to remain undetected.
- sejje 13y agoThat's a stretch, and there's no mention of that in the article.
- dhughes 13y agoJust look for the dude with glitter on his face.
- dredmorbius 13y agoIn all seriousness: glitter gets everywhere. Something I learned in a non-security context.... You can (by means) embarrass / frustrate / reveal undesired examination / tampering of possessions by placing one or more "glitter bombs" in them. A sealed bag, container, envelope, etc. Use different colors to reveal to you just what was accessed.
- 001sky 13y agoglitter <nailpolish> !
- dhughes 13y agoIt has to dry eventually, glitter falls off.
- guynamedloren 13y agoAgreed, should be titled something like "Use glitter nail polish to detect if your laptop has been tampered with"
- algorias 13y agoAs mentioned in the article: before logging into a VPN, make sure your laptop hasn't been tampered with. You just downgraded the consequences of tampering from a security breach to an inconvenience (wiping / replacing your machine).
- source99 13y agoI thought this was gonna be an article about making your laptop look like it belonged to a 14yr old girl and therefore uninteresting to the NSA.
- skyebook 13y agoExactly what I was thinking, and may even hold some truth
- enkephalin 13y agoi wish i were still at the point where i could believe that government agencies weren't interested in the doings of 14 year old girls (or kids in general).
- sillysaurus2 13y agoEDIT: Holy smokes. I wasn't trying to be inflammatory. Sorry. I was only saying not to trust that this is an absolute guarantee that your laptop hasn't been tampered with. Even the top comment is misleading -- "this doesn't prevent tampering, it just makes it obvious to you, as the laptop owner, that your machine has been tampered with. Still useful, but then what are you supposed to do about it?" This method provides no guarantee of detecting tampering. It provides a guarantee that if an adversary is dumb and unaware of this method, then they may break the seal and get themselves caught. But it's a bad idea to be confident that the seal itself is evidence you haven't been tampered with. Would anyone please explain which ideas are mistaken and why?
- neohaven 13y agoDid you read the article? It provides an idea for a tamper-evident seal. Nothing more.
- sillysaurus2 13y agoPeople are going to apply this tamper-evident seal and believe they are secure when it hasn't been tampered with. That's dangerous, because it assumes an adversary has no way of bypassing the seal. That's quite an assumption. And if you're not getting security guarantees, then what kind of security are you getting?
- runjake 13y ago1.) This is just a particular method to detect tampering. It's pretty clever in a lot of ways. As mentioned elsewhere, try reading the article. 2.) The presenters specifically mention that this isn't the "be all/end all" of detecting tampering and the sort of people who would believe that probably have no interest in watching this presentation. Relax.
- prawn 13y agoNo one is actually going to do this, just talk about it. Further, those interested would be well aware of the limitations.
- wyck 13y agoWax stamps, for the internet dark age.
- rexreed 13y agoHow are you supposed to glitter over a laptop's ports?
- anigbrowl 13y agoPut a sticker over them, put glitter on the sticker edges.
- deleted 13y ago[deleted]
- hapless 13y agoThis won't stop firmware attacks.
- deleted 13y ago[deleted]
- atmosx 13y agoUhm, well that's another level of paranoia all together. The more solutions the better, even to problems that we (me at least) most probably will never have (or at least, I hope so!).
- DanAndersen 13y ago"He put the diary away in the drawer. It was quite useless to think of hiding it, but he could at least make sure whether or not its existence had been discovered. A hair laid across the page-ends was too obvious. With the tip of his finger he picked up an identifiable grain of whitish dust and deposited it on the corner of the cover, where it was bound to be shaken off if the book was moved."
- Theodores 13y agoJust buy a HP/Compaq CQ series notebook and make sure that you aren't going to be parted with it for more than the ten hours needed to get to the hard drive. Simple. Jesting apart, who has not had screws fall out or work loose from a Dell or HP laptop? The likelihood that the screws are in differently due to some secret spy type of person opening the machine is quite unlikely compared to the high likelihood that they have just worked loose of their own accord.
- lucb1e 13y ago> who has not had screws fall out or work loose from a Dell or HP laptop? Me. If your laptop is falling apart, it might be time for a new one.
- dzhiurgis 13y agoI can already imagine US border officer asking "Why do you keep a bottle of nail polish? Are you a terrorist?"
- dredmorbius 13y agoGiving a whole new meaning to "robust tradecraft is such a drag" ...
- ThatGeoGuy 13y agoThere is an interesting comment in the original article, that I wasn't sure about, and figured I'd bring up here: "There was always a question that bogged me. Imagine you are called aside to do a routine border check in airport security area. Imagine they want to inspect your laptop. Can you refuse to surrender your password which encrypts the whole disk? Is there such right to say "Nay, what is mine stays mine"?" As somebody who is not from the USA, are you allowed to ask that they perform any security checks in front of you? Are you allowed to ask for the TSA agent's supervisor and have them walk you through each of the steps? I guess one obvious solution is to carry the laptop/device with you on the flight, and leave the battery/adapter in check luggage, but this becomes more difficult when you consider tablets, phones, and the like. Thoughts? As somebody who may travel to the USA one day, I'd like to hear what kinds of situations you might end up in playing games like this.
- joezydeco 13y agoThe short and general answer is that the border entry area, where you are typically interacting with US Customs, is a "no-man's land" and you basically have zero rights in that zone. That goes for US citizens as well. The simplest result is that they can turn you away from the USA and send you back on the next flight if they think you're a problem or unqualified to enter. You may also be detained and things get worse from there. Carrying a laptop without a charger is not a solution at all. The hard drive can be extracted and read apart from the machine. Same for your phone/SD cards/external disks, etc. The safest way to enter the US it seems is to carry completely blank devices, if you need to carry them at all.
- Crito 13y agoIf you are a US citizen who continuously gets refused reentry at the border, what would happen if you snuck across? Presumably once you were across the border you would have rights again and could not be removed from the US. I imagine you would be arrested, but at least you would be officially back in the system, right?
- VLM 13y ago
- praptak 13y agoThis Slasdot article: http://m.slashdot.org/story/28566 http://m.slashdot.org/story/28566 describes a similar technique - glass spheres in transparent epoxy resin creating an uncopyable optical fingerprint. One of the comments states that tinfoil pieces in clear epoxy photographed from several angles were used as tamper proof seals during the cold war era.
- vacri 13y agoBy taking the picture with a cellphone that is kept with you at all times ... wait a minute, I remember seeing this earlier... Border areas can be especially dangerous, as authorities can confiscate a laptop or cell phone
- joshka 13y agohash photo, remember hash.
- PavlovsCat 13y agoRelevant section of the talk (about all sorts of seals, not just nail polish): https://www.youtube.com/watch?v=d6tdq603z20&t=1h45m31s https://www.youtube.com/watch?v=d6tdq603z20&t=1h45m31s
- haberman 13y agoThis reminds me of 1984, where Winston placed a speck of dust on the corner of his diary. He knew he couldn't prevent the authorities from reading it, he just wanted to know if they had or not. However (spoiler alert) he learns at the end of the book that they were careful to put the speck of dust back just where he left it. This is like that, except it (hopefully) would actually work.
- namlem 13y agoBy far the most unbelievable thing about 1984 was how competent the government was.
- deleted 13y ago[deleted]
- ramy_d 13y agoIs there a substantial risk of mailing your hard drive to your destination and simply travelling with a hollow computer?
- altero 13y agoPerhaps encrypt HDD and store boot loader, kernel and keys on USB?
- lucb1e 13y agoI don't see how this prevents anyone from adding hardware keyloggers, mics to do side channel attacks on private keys, speakers to jump airgaps, etc.
- gesman 13y agoIt's more about "knowing" that your laptop was tampered with. Nothing about "preventing" it from happening. Or knowing "who" was tampered with it. Big difference.
- itsybitsycoder 13y agoIf this got popular, I'm not sure how easy it would be to detect if someone broke your seal, replaced the screws/stickers as they were and resealed it with a clear topcoat of a similar gloss level.
- sfrechtling 13y agoBased on the comments here, I can see that this tamper evidence method is not foolproof. Is there anything that is better (harder to detect, harder to replace even if known about)?
- auctiontheory 13y agoAssuming you were carrying secret information on a business or government trip, wouldn't you carry the data on your person in an encrypted USB drive, with a blank/vanilla OS install on your laptop? That seems more efficient (and effective) than all this glitter spraying and photography.
- judk 13y agoThis article is useless without pics
- rdl 13y agoGood idea; we're doing another talk at RSA where we drop some tools, so I'll set up a macro rig and take some pics/videos for a supporting website. I need to buy a ring flash which actually doesn't suck, I think.
- rdl 13y agoHi -- this was a fun talk to give. The big point which wasn't so clear is that seals are not locks. Seals exist to identify tampering; locks exist to prevent it. We use a software tool (and remote network service) to turn seals into (electronic) locks, which is kind of cool -- the integrity is measured locally using a trusted device (iPhone for now, eventually something better), verified remotely, and then a 2FA token is returned. Glitter nail polish is maybe 70% good for this, but has the huge advantage of being widely available. Part of the goal here is to travel completely "naked" to a country, then buy a random local laptop, other local stuff, and tools, and then be able to re-create your capabilities. There are some custom conformal coatings which are brittle, much harder to pry off, single-layer, etc. which we've played around with which work much better. Plus actual paper/tape/plastic seals, and indicators already in devices (manufacturing defects like the grain of a casting). Hooking this stuff into conventional security measures (MDM, VPN, FDE, various access control, etc.) is the ultimate goal; it's useless to detect tampering if your data is all they're after and unencrypted, after all. My coauthor Eric Michaud is a former safeguard seals guy from Department of Energy's VAT, probably one of USG's top 3 seals programs (and probably one of the top 10 seals groups in the world), and has a physical security company (and is a lock expert), so I've been learning a lot from him about that technology.
- deegles 13y ago"Border areas can be especially dangerous, as authorities can confiscate a laptop or cell phone to “examine” it, then return it with the drives imaged or malware installed." Has anyone actually had this happen to them? What was the fallout from it?