Make Your Electronics Tamper-Evident

Here's some work I did a couple years ago using some of these principles to fight counterfeit medicines: https://www.nature.com/articles/s41598-022-11234-4

A side note: I think there's an unmet need for algorithms that can convert photos of these random patterns into text (or something similar) that can be stored in a database and searched quickly for matching patterns. I've tried image similarity algorithms like the ones used by e.g. Google Reverse Image Search, but they seem poorly suited for this task. I ended up writing my own crude algorithm in the paper above that converts a pattern into a set of strings, and it works OK, but surely there are better ways to do this.

Cameras continue to shrink in size and price. TEMPEST / Van Eck phreaking can be used to detect and locate hidden cameras, https://www.usenix.org/system/files/sec24fall-prepub-357-zha...

> For all spy cameras.. raw image.. encoding and compression.. takes place in an inbuilt read-write memory whose operations cause electromagnetic radiation (EMR).. Whenever the visual scene changes, bursts of video data processing.. aggravate the memory workload, bringing responsive EMR patterns. ESauron can detect spy cameras by intentionally stimulating scene changes and then sensing the surge of EMRs.. Experiments with 50 camera products show that ESauron can detect all spy cameras with an accuracy of 100% after only 4 stimuli, the detection range can exceed 20 meters even in the presence of blockages, and all spy cameras can be accurately located.

There are DoD standards for this. Mostly for SECRET level. Containers for SECRET level material are supposed to be tamper-evident, but not extremely resistant to attack. Filing cabinets must have welded and painted joints, and good locks. It's possible to pry open a secure filing cabinet, but the damage will show. See page 5.3.1 of [1].

The U.S. Navy does authorize label-type seals but rates their security as "minimal". See page 6.3 of [2]

Defense Counterintelligence Agency has some security seal guidelines.[3] Probably outdated.

There are "tamper-evident seals with residue." If you remove them, it makes a visible mess. [4] They also have bar-coded serial numbers. A well-resourced attacker with a lot of access time and a preliminary run to get a look at the seals and have duplicates made could probably remove and replace those. If you're facing that level of threat you probably shouldn't have anything of interest in an unattended laptop.

[1] https://www.nispom.org/NISPOMwithISLsMay2014.pdf

[2] https://exwc.navfac.navy.mil/Portals/88/Documents/EXWC/DoD_L...

[3] https://www.dcsa.mil/Portals/91/Documents/CTP/NAO/security_s...

[4] https://seals.com/security-tape-labels/?_bc_fsnf=1&Classific...

My first exposure to “tamper evident” mechanisms was in an anime series called “Death Note”.

https://youtube.com/watch?v=zZBR9iQ7DRA3D

The main character has a series of mechanisms (door latch height, paper in between door and wall, mechanical pencil lead in door hinge)

One out of place tamper seal, can ignore. But all 3 broken? Someone was in the room.

Personally used the paper trick when I was young and living with parents and siblings. Would easily know when somebody entered and trifled through my things.

Also used that mechanical lead pencil trick with my “secret” drawer where I had created a false bottom lol.

I had to disassemble our relatively new Roborock vacuum to clean it fully (it found a piece of dog waste and made a lovely mess). I removed every screw I could find and still couldn't remove the bottom cover. That's when I noticed what looked like a hole with a plastic filler, but was actually a bit of wax covering the final screw. I presume this was a simple way to determine if the device had been tampered, for warranty purposes.

I would love to hear more about the kind of work done by people that need this level of security.

Like is the NSA covering their laptop screws in glitter nail polish? Are covert CIA agents? SOF?

Who needs this level of secrecy that would not have the physical security in place to protect the device in the first place?

This reminds me an old James Bond movie, with Sean Connery, where he picks one of his hair, licks his sticky fingers to seal his hotel room door. It later tells him that someone entered his room.

I have thought about this many times when thinking about the Framework Laptop. How easy it would be to swap one of the side ports with a malicious version that has something like a keylogger in it and you would never be the wiser.

Happy to see this, because this is how they (Law enforcement / intelligence agencies) do it nowadays.

Many years ago law enforcement (french DCRI now called DGSI) illegally placed a keylogger on my laptop, they placed it when I bought it online from materiel.net and placed it before I took delivery of it. it is 100% certain in my mind.

So never ever buy a laptop or hardware online if you think you might be exposed to this, buy it from a store.

I was going to build a hardware keylogger for laptops just for fun and as a proof-of-concept to show how easily this could be done.

I find that this has much more promise than all the crap about Secure Boot and the like for the far-fetched "evil maid" scenario. NO ONE I know is going to react to Windows going batshit and requesting the Bitlocker key for no reason as "my laptop has been tampered with!". Heck, given large enough number of employees, IT has to hand out the bitlocker keys almost every day due to how frequent false positives are.

On the other hand, I'd think they'd pay attention to actual tampering evidence.

> If the police

Not just the police: if your data or the data of the organization you work for is considered valuable enough[0], you also have to worry about thieves, foreign spies/saboteurs, corporate espionage, a wayward relative looking for banking passwords or Bitcoin to fund their drug/gambling habit, or a particularly obsessive ex.

[0] Mine isn't, and paranoia isn't one of my vices, so this is all academic to me.

I wonder if the colourful lentils trick could be bypassed by a 3D printer that recreates the pattern. This seems in range for a state actor. Or maybe even a hobbyist with lots of time.

If this topic is a serious concern in your threat modeling, then this is a far better solution than glitter nail polish, and also doubles as a digital identity signature:

https://dustidentity.com/

I'm looking at using this for certain shipping and packaging needs.

The problem with this technique is that now you have to inspect the seal every time you leave your laptop unattended.

Tamper proof screws, but do you check underneath your laptop every time you went away for a few minutes?

I remember reading an article from MIT earlier this year where they deposited metallic particles into adhesive of an id tag and registered the unique dispertion of the metallic particles as a way to verify a genuine or fake product https://news.mit.edu/2024/tiny-tamper-proof-id-tag-can-authe...

Yes. It's a good idea.

However it's worth not also gaining a false sense of security vs. state actors who buy software and hardware exploits from shops like Zerodium generally don't always require intrusive physical access to implant malware or extract information, or who use the local carriers to do the dirty work for them.

https://archive.ph/sNJgw (page hugged to death?)

Ctrl F tamper tape

amazon dot com tamper tape

You can't open the case in a way that doesn't make it obvious it was opened.

"As anarchists, we must defend ourselves against police and intelligence agencies that conduct targeted digital surveillance for the purposes of incrimination and network mapping." (https://www.anarsec.guide/recommendations/)

I wonder who the anarchists are that are afraid of "incrimination and network mapping" and what it is they're doing them that makes them afraid of that