Gaping security flaw exposed on anti-tamper devices
Devices from those used to track nuclear materials to warranty seals on Xbox consoles easily circumvented
Computerworld - ARLINGTON, VA. -- Security devices used in transportation, packaging and even in accounting for nuclear materials are very vulnerable to attack, two security researchers warned on Tuesday at the Black Hat security conference.
The physical security devices, known as "tamper-evident devices,' aren't intended to prevent theft but to alert inspectors that something has been broken into.
The devices are wide-ranging in design and application, and are used to seal everything from evidence bags, large shipping containers and even things like the warranty seal on an Xbox gaming console.
Jamie Schwettmann and Eric Michaud of i11 Industries went through a long list of tamper evident devices at the conference here and explained, step-by-step, how each seal can be circumvented with common items, such as various solvents, hypodermic needles, razors, blow driers, and in more difficult cases with the help of tools such as drills.
Tamper-evident devices may be as old as civilization, and today are used in everyday products such as aspirin containers' paper seals. The more difficult devices may be bolt locks designed to secure shipping containers, or polycarbonate locks designed to shatter if cut.
But they all share something in common: They can be removed and the anti-tampering device reassembled.
Tampering can be discovered if people are looking specifically for it and test for it, but in most cases all these devices get is a "just kind of a once-over," said Schwettmann, "because we put so much trust in these things."
Michaud, who has worked on the Argonne Vulnerability Assessment Team training International Atomic Energy Agency (IAEA) inspectors, said the same type of anti-tamper devices used commercially are also used on containers that may store nuclear devices, waste, and equipment to help verify arms treaties.
Michaud believes those seals can be tampered with. "It's a massive risk," he said.
There aren't any controls on the use of the seals, said Michaud. He called one maker of seals and asked them for a sample. They sent "a non-voided legitimate stack of them," he said. If he wanted to forge the seals, he could have, he said.
Patrick Thibodeau covers SaaS and enterprise applications, outsourcing, government IT policies, data centers and IT workforce issues for Computerworld. Follow Patrick on Twitter at @DCgov or subscribe to Patrick's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts