Don't want your laptop tampered with? Just add glitter nail polish

http://www.wired.com/threatlevel/2013/12/better-data-security-nail-polish/

by rdl • 13 years ago

221 82 13 years ago

randall• 13 years ago

Clever!

Misleading title - this doesn't prevent tampering, it just makes it obvious to you, as the laptop owner, that your machine has been tampered with. Still useful, but then what are you supposed to do about it?

deletes• 13 years ago

You are informed that the machine is not to be trusted. From then on proceed depending on how secure your data is.

manojlds• 13 years ago

Still, misleading title.

huhtenberg• 13 years ago

It may actually prevent tampering if the tampering is supposed to remain undetected.

sejje• 13 years ago

That's a stretch, and there's no mention of that in the article.

dhughes2• 13 years ago

Just look for the dude with glitter on his face.

guynamedloren• 13 years ago

Agreed, should be titled something like "Use glitter nail polish to detect if your laptop has been tampered with"

algorias• 13 years ago

As mentioned in the article: before logging into a VPN, make sure your laptop hasn't been tampered with. You just downgraded the consequences of tampering from a security breach to an inconvenience (wiping / replacing your machine).

source99• 13 years ago

I thought this was gonna be an article about making your laptop look like it belonged to a 14yr old girl and therefore uninteresting to the NSA.

skyebook• 13 years ago

Exactly what I was thinking, and may even hold some truth

enkephalin• 13 years ago

i wish i were still at the point where i could believe that government agencies weren't interested in the doings of 14 year old girls (or kids in general).

sillysaurus25• 13 years ago

EDIT: Holy smokes. I wasn't trying to be inflammatory. Sorry. I was only saying not to trust that this is an absolute guarantee that your laptop hasn't been tampered with.

Even the top comment is misleading -- "this doesn't prevent tampering, it just makes it obvious to you, as the laptop owner, that your machine has been tampered with. Still useful, but then what are you supposed to do about it?"

This method provides no guarantee of detecting tampering. It provides a guarantee that if an adversary is dumb and unaware of this method, then they may break the seal and get themselves caught. But it's a bad idea to be confident that the seal itself is evidence you haven't been tampered with.

Would anyone please explain which ideas are mistaken and why?

neohaven• 13 years ago

Did you read the article?

It provides an idea for a tamper-evident seal. Nothing more.

sillysaurus25• 13 years ago

People are going to apply this tamper-evident seal and believe they are secure when it hasn't been tampered with. That's dangerous, because it assumes an adversary has no way of bypassing the seal. That's quite an assumption. And if you're not getting security guarantees, then what kind of security are you getting?

runjake2• 13 years ago

You've went ahead and since heavily edited your comment after all the downvoting, but your initial comment was asinine and demonstrated that you had little understanding of the contents of the article (eg. probably didn't read the article).

That's why you're seeing all of the downvotes.

sillysaurus25• 13 years ago

I read the article. It makes no mention of the fact that this isn't any guarantee your laptop hasn't been tampered with. Was it asinine to call this "another false sense of security" and "humans have invented ways around every lock in existence"?

It felt very much like people were going out of their way to misread me, so I replaced my comment with one that was absolutely clear that I was saying "this provides no guaranteed way of detecting tampering." Which is true, no?

I recently promised the mods that I'd try hard to be less inflammatory, and I was legitimately shocked to see my comment downvoted to oblivion when it seemed to contain no mistaken ideas. I'm doing my best to learn from this experience, but no one is providing anything for me to learn from. All I've learned is not to warn people about invalid security assumptions...

dredmorbius7• 13 years ago

First off, there's a whole school and practice of security measures which is aimed more at revealing breaches than in preventing them, per se. Audits, tamper-evident seals, tell-tales placed in maps, watermarks in documents or images, and very large swaths of system monitoring, reporting, and alerting. Much of military electronic security "Orange Book" procedures have much more to do with auditing than they do securing data.

Sometimes the goal is to determine what was taken or breached, sometimes who violated confidentiality (especially via watermarks or telltales), or how.

In some cases, the goal may be to ensure/assess planted information was actually accessed. One counterintelligence mission, Operation Mincemeat from WWII involved landing a dead body (a deceased criminal if memory serves) with bogus military plans, and a pretty elaborate back-story, to mislead German intelligence into thinking an Allied attack would occur in Greece rather than Sicily. Part of the assessment of the plan involved determining whether or not the Germans had in fact examined the documents, and forensics showed that the corners of the papers indicated that they had been secured in a manner consistent with being photographed.

https://en.wikipedia.org/wiki/Operation_Mincemeat

Another case might be, say, a journalist who wanted to be able to positively demonstrate that electronics were accessed without authorization by officials (whether in a border crossing or some other means). The glitter polish trick would make for a useful and highly embarrassing bit of evidence which could be shown to the public in the form of before-after photographs.

No, it doesn't prevent access (and the title is misleading), but it does identify access.

sillysaurus25• 13 years ago

I just wanted to thank you for this fantastic comment. Security history is fascinating, and this provides a ton of new material for me to osmose. Do you have any more reading recommendations? I've been wanting to research the WW2 period up through the end of the cold war in particular.

femto• 13 years ago

"..., but then what are you supposed to do about it?"

Maybe run the laptop off a bootable USB 3.0 stick, which you keep in your pocket? The file system actually on the laptop could serve as a honeypot.

wyck• 13 years ago

Wax stamps, for the internet dark age.

rexreed• 13 years ago

How are you supposed to glitter over a laptop's ports?

anigbrowl• 13 years ago

Put a sticker over them, put glitter on the sticker edges.

atmosx• 13 years ago

Uhm, well that's another level of paranoia all together. The more solutions the better, even to problems that we (me at least) most probably will never have (or at least, I hope so!).

DanAndersen• 13 years ago

"He put the diary away in the drawer. It was quite useless to think of hiding it, but he could at least make sure whether or not its existence had been discovered. A hair laid across the page-ends was too obvious. With the tip of his finger he picked up an identifiable grain of whitish dust and deposited it on the corner of the cover, where it was bound to be shaken off if the book was moved."

Theodores• 13 years ago

Just buy a HP/Compaq CQ series notebook and make sure that you aren't going to be parted with it for more than the ten hours needed to get to the hard drive. Simple.

Jesting apart, who has not had screws fall out or work loose from a Dell or HP laptop? The likelihood that the screws are in differently due to some secret spy type of person opening the machine is quite unlikely compared to the high likelihood that they have just worked loose of their own accord.

lucb1e2• 13 years ago

who has not had screws fall out or work loose from a Dell or HP laptop?

Me. If your laptop is falling apart, it might be time for a new one.

dzhiurgis• 13 years ago

I can already imagine US border officer asking "Why do you keep a bottle of nail polish? Are you a terrorist?"

dredmorbius7• 13 years ago

Giving a whole new meaning to "robust tradecraft is such a drag" ...

ThatGeoGuy2• 13 years ago

There is an interesting comment in the original article, that I wasn't sure about, and figured I'd bring up here:

"There was always a question that bogged me. Imagine you are called aside to do a routine border check in airport security area. Imagine they want to inspect your laptop. Can you refuse to surrender your password which encrypts the whole disk? Is there such right to say "Nay, what is mine stays mine"?"

As somebody who is not from the USA, are you allowed to ask that they perform any security checks in front of you? Are you allowed to ask for the TSA agent's supervisor and have them walk you through each of the steps?

I guess one obvious solution is to carry the laptop/device with you on the flight, and leave the battery/adapter in check luggage, but this becomes more difficult when you consider tablets, phones, and the like. Thoughts? As somebody who may travel to the USA one day, I'd like to hear what kinds of situations you might end up in playing games like this.

joezydeco3• 13 years ago

The short and general answer is that the border entry area, where you are typically interacting with US Customs, is a "no-man's land" and you basically have zero rights in that zone. That goes for US citizens as well.

The simplest result is that they can turn you away from the USA and send you back on the next flight if they think you're a problem or unqualified to enter. You may also be detained and things get worse from there.

Carrying a laptop without a charger is not a solution at all. The hard drive can be extracted and read apart from the machine. Same for your phone/SD cards/external disks, etc.

The safest way to enter the US it seems is to carry completely blank devices, if you need to carry them at all.

Crito3• 13 years ago

If you are a US citizen who continuously gets refused reentry at the border, what would happen if you snuck across?

Presumably once you were across the border you would have rights again and could not be removed from the US. I imagine you would be arrested, but at least you would be officially back in the system, right?

ThatGeoGuy2• 13 years ago

The hard drive can be extracted and read apart from the machine. Same for your phone/SD cards/external disks, etc.

Perhaps, but in this case we can assume encryption works. They can't expect you to unencrypt the drive if you don't have a power source. And really, they have less leverage to bully you into needing to operate the computer for security reasons, especially if you can show there's no way the computer can operate during flight.

fractallyte• 13 years ago

This has always bothered me: if it's a "no-man's land", then the situation is symmetrical: they have no rights either.

Has this ever been tested in court?

twobits• 13 years ago

"As somebody who may travel to the USA one day"

Well, if you remove this requirement, I have a solution for you.

SamReidHughes• 13 years ago

Customs is not the TSA.

chrissnell• 13 years ago

What you'd want is an encryption system that had two passwords: one that was accepted and caused the de-encryption of a volume of data that looked real, plausible, and had recent atime/mtime timestamps but wasn't actually your secret data. You would also have a second password, the existence of which you wouldn't reveal, that would also be accepted but result in the de-encryption of your true volume with your secret data.

I think truecrypt has something like this but I wouldn't trust truecrypt to my data. Not in this day and age.

praptak• 13 years ago

This Slasdot article: http://m.slashdot.org/story/28566

describes a similar technique - glass spheres in transparent epoxy resin creating an uncopyable optical fingerprint. One of the comments states that tinfoil pieces in clear epoxy photographed from several angles were used as tamper proof seals during the cold war era.

vacri• 13 years ago

By taking the picture with a cellphone that is kept with you at all times

... wait a minute, I remember seeing this earlier...

Border areas can be especially dangerous, as authorities can confiscate a laptop or cell phone

joshka• 13 years ago

hash photo, remember hash.

PavlovsCat• 13 years ago

Relevant section of the talk (about all sorts of seals, not just nail polish):

https://www.youtube.com/watch?v=d6tdq603z20&t=1h45m31s

haberman• 13 years ago

This reminds me of 1984, where Winston placed a speck of dust on the corner of his diary. He knew he couldn't prevent the authorities from reading it, he just wanted to know if they had or not. However (spoiler alert) he learns at the end of the book that they were careful to put the speck of dust back just where he left it.

This is like that, except it (hopefully) would actually work.

namlem• 13 years ago

By far the most unbelievable thing about 1984 was how competent the government was.

ramy_d• 13 years ago

Is there a substantial risk of mailing your hard drive to your destination and simply travelling with a hollow computer?

altero• 13 years ago

Perhaps encrypt HDD and store boot loader, kernel and keys on USB?

lucb1e2• 13 years ago

I don't see how this prevents anyone from adding hardware keyloggers, mics to do side channel attacks on private keys, speakers to jump airgaps, etc.

gesman• 13 years ago

It's more about "knowing" that your laptop was tampered with.

Nothing about "preventing" it from happening. Or knowing "who" was tampered with it.

Big difference.

itsybitsycoder• 13 years ago

If this got popular, I'm not sure how easy it would be to detect if someone broke your seal, replaced the screws/stickers as they were and resealed it with a clear topcoat of a similar gloss level.

sfrechtling• 13 years ago

Based on the comments here, I can see that this tamper evidence method is not foolproof. Is there anything that is better (harder to detect, harder to replace even if known about)?

auctiontheory• 13 years ago

Assuming you were carrying secret information on a business or government trip, wouldn't you carry the data on your person in an encrypted USB drive, with a blank/vanilla OS install on your laptop? That seems more efficient (and effective) than all this glitter spraying and photography.

judk• 13 years ago

This article is useless without pics

rdl2• 13 years ago

Good idea; we're doing another talk at RSA where we drop some tools, so I'll set up a macro rig and take some pics/videos for a supporting website. I need to buy a ring flash which actually doesn't suck, I think.

rdl2• 13 years ago

Hi -- this was a fun talk to give.

The big point which wasn't so clear is that seals are not locks. Seals exist to identify tampering; locks exist to prevent it. We use a software tool (and remote network service) to turn seals into (electronic) locks, which is kind of cool -- the integrity is measured locally using a trusted device (iPhone for now, eventually something better), verified remotely, and then a 2FA token is returned.

Glitter nail polish is maybe 70% good for this, but has the huge advantage of being widely available. Part of the goal here is to travel completely "naked" to a country, then buy a random local laptop, other local stuff, and tools, and then be able to re-create your capabilities. There are some custom conformal coatings which are brittle, much harder to pry off, single-layer, etc. which we've played around with which work much better. Plus actual paper/tape/plastic seals, and indicators already in devices (manufacturing defects like the grain of a casting).

Hooking this stuff into conventional security measures (MDM, VPN, FDE, various access control, etc.) is the ultimate goal; it's useless to detect tampering if your data is all they're after and unencrypted, after all.

My coauthor Eric Michaud is a former safeguard seals guy from Department of Energy's VAT, probably one of USG's top 3 seals programs (and probably one of the top 10 seals groups in the world), and has a physical security company (and is a lock expert), so I've been learning a lot from him about that technology.

deegles• 13 years ago

"Border areas can be especially dangerous, as authorities can confiscate a laptop or cell phone to “examine” it, then return it with the drives imaged or malware installed."

Has anyone actually had this happen to them? What was the fallout from it?

Don't want your laptop tampered with? Just add glitter nail polish

Related Stories