5 ms·

I used to work as a penetration tester, and one of our clients hired us to perform a "custom application" assessment. I can't give specific details (for obvious

I used to work as a penetration tester, and one of our clients hired us to perform a "custom application" assessment. I can't give specific details (for obvious NDA-related reasons), but this application was a large device that interfaced with mission-critical hardware -- and ran Windows XP embedded. They'd done a pretty good job securing the OS and device itself: we couldn't actually connect it to any networks, so network penetration testing was difficult, and there were no USB ports or CD drives. Unfortunately for them, they did leave an archaic port open on the back of the device. Now, this wasn't a USB port or anything, but (with certain difficult-to-source adaptors) we were able to get an external 3.5" floppy drive hooked up -- through which we could (slowly) load arbitrary executables, and take over the device. When we explained this finding, the client told us that certain customers of theirs required this port for proprietary communication, and that they couldn't remove it from production. The end result was that for every production run of this device that wasn't going to one of those edge-case customers, epoxy was manually applied to close off the port. Not the most elegant solution, but I guess it worked!

x0054 11y ago
Why not simply score the motherboard around the port to cut the traces? Epoxy sounds like such an inelegant solution. But I am a neat freak :)
- xenophonf 11y ago
  I personally would prefer epoxy because just about anybody can apply it, whereas to safely cut traces on a motherboard requires someone with a modicum of technical skill, the purchase of suitable tools, hardware testing afterwards, etc.
  - x0054 11y ago
    That's true, but isn't the company making these devices? If they are making them, they must have someone capable of operating an x-acto knife. Also, if you are concern about an attack that requires someone to load code very slowly from floppy, wouldn't you also be concerned about someone using a battery operated rotary tool to cut the epoxy around the pins, and then connecting probes to those pins which would allow to than connect the floppy drive.
    - simoncion 11y ago
      Epoxied ports are like locks. They're there to keep honest people out and to slow down (and in the case of epoxied ports, really slow down) dishonest people. I don't know where the hardware was going, but computers are often either located in places where only trusted employees are permitted, or where there is not-infrequent foot traffic. Combine either trusted employees or random, unpredictable passers-by with regular inspection of the hardware, and you have a pretty decent solution. Epoxied ports can also be used as an after-the-fact intrusion warning. You know the thing was epoxied from the factory. If your inspection reveals that the epoxy is missing or has been altered, then you're almost certain that something nefarious was going on.
      - x0054 11y ago
        Some time ago, around 2008, I let my friend use my bicycle for a few weeks. He ended up loosing a key to the bike lock, and I had to cut off the lock to get the bike out. So here I was, with an battery operated angle grinder, wearing a hoody, cutting a bike lock in the middle of downtown San Diego at 4pm on a weekday with streets full of people, 4 blocks from central jail, and cops going up and down the street. It took me 15 min to grind though the lock, and it made a lot of noise. No one even bothered to ask me what I was doing, people were walking by as if I didn't exist. Cops drove by without stopping. My point is, if these machines were destined for public places, it wouldn't surprise me if a man in overalls could sit next to them and grind away epoxy with impunity for hours before anyone would think twice about it.
        johnmaguire2013 11y ago
        The ABC show "What would you do?" actually did a bit about bike thieves: https://www.youtube.com/watch?v=8ABRlWybBqM https://www.youtube.com/watch?v=8ABRlWybBqM I don't really consider the show to be scientific, it's purely anecdotal, but it's definitely kind of interesting.
        simoncion 11y ago
        From the story, it sounds like the client actually cared about the security of these devices. I would be somewhat surprised if they were left unobserved long enough for someone to surreptitiously carve out the epoxy and attach a drive to it. Though, we can't know if the client was looking for intrusion prevention, or merely after-the-fact intrusion detection. :)
- kejaed 11y ago
  Using epoxy It would also allow the production line to only make one model to sit on the shelf and then epoxy the ones going to Customer X when they need to go out to them. If you cut the traces then you'd have to make 2 different types and track them, and really make sure none of the cut traces ones make it to Customer X.
- WalterBright 11y ago
  Epoxy is easy to visually inspect and verify.
Mandatum 11y ago
Would it not be trivial to spray a can of air upside-down at the epoxy for 30 secs and scrape it out with a screwdriver or craft knife? Paint thinner takes too long and a heat gun isn't exactly mobile (also sticky, eck).
- xenophonf 11y ago
  Done correctly, seals aren't tamper-proof but tamper-evident. A little bit of glue isn't going to stop someone determined to steal from my hypothetical bank, but at least I'll know about it.

x0054 11y ago

Why not simply score the motherboard around the port to cut the traces? Epoxy sounds like such an inelegant solution. But I am a neat freak :)

xenophonf 11y ago
I personally would prefer epoxy because just about anybody can apply it, whereas to safely cut traces on a motherboard requires someone with a modicum of technical skill, the purchase of suitable tools, hardware testing afterwards, etc.
- x0054 11y ago
  That's true, but isn't the company making these devices? If they are making them, they must have someone capable of operating an x-acto knife. Also, if you are concern about an attack that requires someone to load code very slowly from floppy, wouldn't you also be concerned about someone using a battery operated rotary tool to cut the epoxy around the pins, and then connecting probes to those pins which would allow to than connect the floppy drive.
  - simoncion 11y ago
    Epoxied ports are like locks. They're there to keep honest people out and to slow down (and in the case of epoxied ports, really slow down) dishonest people. I don't know where the hardware was going, but computers are often either located in places where only trusted employees are permitted, or where there is not-infrequent foot traffic. Combine either trusted employees or random, unpredictable passers-by with regular inspection of the hardware, and you have a pretty decent solution. Epoxied ports can also be used as an after-the-fact intrusion warning. You know the thing was epoxied from the factory. If your inspection reveals that the epoxy is missing or has been altered, then you're almost certain that something nefarious was going on.
    - x0054 11y ago
      Some time ago, around 2008, I let my friend use my bicycle for a few weeks. He ended up loosing a key to the bike lock, and I had to cut off the lock to get the bike out. So here I was, with an battery operated angle grinder, wearing a hoody, cutting a bike lock in the middle of downtown San Diego at 4pm on a weekday with streets full of people, 4 blocks from central jail, and cops going up and down the street. It took me 15 min to grind though the lock, and it made a lot of noise. No one even bothered to ask me what I was doing, people were walking by as if I didn't exist. Cops drove by without stopping. My point is, if these machines were destined for public places, it wouldn't surprise me if a man in overalls could sit next to them and grind away epoxy with impunity for hours before anyone would think twice about it.
      - johnmaguire2013 11y ago
        The ABC show "What would you do?" actually did a bit about bike thieves: https://www.youtube.com/watch?v=8ABRlWybBqM https://www.youtube.com/watch?v=8ABRlWybBqM I don't really consider the show to be scientific, it's purely anecdotal, but it's definitely kind of interesting.
      - simoncion 11y ago
        From the story, it sounds like the client actually cared about the security of these devices. I would be somewhat surprised if they were left unobserved long enough for someone to surreptitiously carve out the epoxy and attach a drive to it. Though, we can't know if the client was looking for intrusion prevention, or merely after-the-fact intrusion detection. :)
kejaed 11y ago
Using epoxy It would also allow the production line to only make one model to sit on the shelf and then epoxy the ones going to Customer X when they need to go out to them. If you cut the traces then you'd have to make 2 different types and track them, and really make sure none of the cut traces ones make it to Customer X.
WalterBright 11y ago
Epoxy is easy to visually inspect and verify.

Mandatum 11y ago

Would it not be trivial to spray a can of air upside-down at the epoxy for 30 secs and scrape it out with a screwdriver or craft knife? Paint thinner takes too long and a heat gun isn't exactly mobile (also sticky, eck).

xenophonf 11y ago
Done correctly, seals aren't tamper-proof but tamper-evident. A little bit of glue isn't going to stop someone determined to steal from my hypothetical bank, but at least I'll know about it.