Methods for protecting computer systems from physical attacks

Question

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures.

Consider the following attack scenario: An attacker would like to obtain data from a harddrive. The target machine is setup with Full Disk Encryption, a bios password is set and the boot priority states that the encrypted drive is the first device to be booted.

The passphrase must be typed in order decrypt the drive and boot the machine. A Hardware Keylogger could be installed to obtain this value. Some full disk encryption implementations can be defeated with Bus Sniffing, however in order to carry out this attack the computer case must be opened. In either attack, after a period of time the attacker can return and collect the harddrive and intercepted passphrase.

How can you detect if your computer case has been opened? How can you thwart the use of a hardware keylogger?

Also here is a great talk on Bypassing Tamper Evident Devices.

Edit: The state of modern physical security is incredibly poor. Literally every door lock available at my local Walmart can be picked in seconds. Most homes in the US are still using pin tumbler locks that originally invented by the Egyptians thousands of years ago.

Answer 1

The problem with trying to detect these attacks is that their common target - desktop workstations - largely goes unobserved for most of its life. Even if it actually sits on the desktop, users rarely pay attention to it except to push the power button, insert/remove removable media, or plug/un-plug accessories - all of which generally can be done from the front of the system, while the simplest way to hide these attacks is to plug into the rear. You could perhaps mandate that all desktops be kept actually on the desktop, and have all peripherals plugged into front-facing ports, but that almost certainly won't gain good user acceptance.

There probably is no easy way to thwart a hardware keylogger, except to regularly check your peripheral connections. You can include this in your end-user training, but it's unlikely to ever actually be done by them and it increases the probability that they'll have to call for help when they've inadvertently unplugged something essential in the process. A better method, if there must be one, may be to have a team of technicians perform regular hardware inspections.

The easiest and most cost-effective way to detect breaches into the computer case itself would be to use stickers akin to the ones OEMs use for warranty validation. Of course, this would require that you regularly check said sticker to verify it hasn't been tampered with. Again, this is not something that would be well accepted or implemented by the end-user. So, it will be up to your technicians to regularly inspect their systems. You'll also have to make sure that said technicians have access to the stickers so that they can apply new ones whenever they service the systems, but then we wander into the possibility of insider attacks.

Alternately, some cases and motherboards support hardware-based monitors which can alert you at boot-time if the case was opened since the last power-on. These may or may not be easily circumvented (i.e.: Attacker covers his track by power-cycling the system to dismiss the alert before the victim uses it again.) depending on design, and again may still be vulnerable to insider threats.

Answer 2

The problem with physical security is this:

If the attacker has physical access to the machine, then there is no security.

Unfortunately, there is very little that can be done about it for a end-user workstation. Where I work, we use workstations that really are desktops. So placing a security sticker on the case in front in plain sight of the end-user is easy. Case intrusion systems can send an alert if the case was opened, but those can also be countered as well. The best security solution that I can think of is four fold.

1. Physical access controls to the location where the computers are kept. Employees who are authorized to work in that location can use either a RFID card or some magnetic stripe or barcode on their ID badge to gain access through a locked door. This allows the accesses to the location to be audited on a per employee basis.

2. Force the users to use two factor authentication: Something that you know with something that you have. There are several solutions on the market for this. One example being the widely popular RSA SecurID tokens.

3. Do not store sensitive data on the end-user machines. Only store it on the server. Enforce data security using network access controls.

4. Educate your users.

An interesting effect of #1 is that if a user logs into a computer at a location in which there is no record of them accessing the location, that discrepancy can be flagged for review. Also, configure a solution that displays, prominently, upon login the last time they logged in and the duration of the login. Unix machines do this already, but I have not seen this with Windows machines.

For servers, machines are usually stored in a back room somewhere. Instead of using a key to enter a locked server room, use the method for #1. That way, access is restricted to the room, access audits can be performed, and if someone is let go for some reason, you can remove them from the access system and not worry about them having made a duplicate key to the room.

As a side note, I would like to mention that a if a sufficiently motivated attacker gained access to a computer and removed the hard disk, not even a hardware password for the harddisk will stop them from gaining access to the data stored on the drive. I read somewhere awhile back that the drive itself stores the encryption key, in the clear mind you, on the disk platters in a location that the user cannot access. However, an attacker can open the drive and read the key directly and thereby decrypt the whole drive.

In the end, a sufficiently motivated attacker cannot be stopped short of arresting and prosecuting them when it comes to physical security. Or dragging them out and shooting them...twice for good measure.

Answer 3

Here is a generic attack which defeats most of the (otherwise good) ideas which are exposed here:

The attacker buys a PC case which looks like the target system. Inside, he puts a system which presents the same login screen as the target system, at the time when it asks for the unlocking password. But as soon as the user enters his password, the system sends the password across the network (possibly wireless) then commits suicide (e.g. it detonates some fireworks to simulate a failing chemical condenser, then goes to a blank screen). The attacker then just has to purloin the complete computer and put his imitation in its place. Sure, this will be discovered, but that will be too late: the attacker already has the hard disk and the unlock password.

(A cheaper and easier similar attack is to replace the keyboard with a replica which looks the same and works the same, but also includes the keylogger.)

Of course this attack cannot be necessarily applied, but because of contextual elements; e.g. the computer is in a public place and there is no way someone could discreetly get away with a full computer case under his arm (unless disguised as some sort of IT operator, with jeans and unkempt beard, in which case this can probably be pulled off). This highlights the importance of the environment.

On a similar note, keylogging can be done remotely. For instance, a camera could be glued by the attacker on the ceiling, with a full view of the keyboard. This is done a lot with ATM and similar devices (e.g. 24/7 gas pumps) so the cameras and the know-how for their discreet installation are already widespread. This example shows that what matters is not the integrity of the computer, but the integrity of the complete environment where secret data is used, where the "secret data" here includes the user's password.

---

Generically, prevention of attacks such as the one you explain can occur in three ways:

1. The attacker is prevented from altering the physical integrity of the computer, e.g. by not being able to reach it. Example: a locked case around the computer.

2. A system is in place which guarantees, with strong probability, that the attacker will be identified (reliably, and promptly) if he tries his attack. This is a psychological deterrent (this may make the attack "not worth it" for the attacker). Example: security cameras.

3. Assuming that the attack took place, you can detect it at the last minute, right before entering the target password.

Tamper-evident systems concentrate on the third method, but that's a last resort: these system do any good only if the methods at the first two levels failed. In that sense, efforts should first be applied on the two other levels.

Answer 4

I had a Dell computer at one time that would notify me any time the case had been opened. Resetting the notification was done in the BIOS. Probably something similar to a computer case intrusion detection system.

Something like tamper evident tape might work (like the one pictured below).

Answer 5

All defence against physical access requires you to use physical security. The only physical security I can think of is determining a way for you to determine when something has been tampered with. If you've established this you know not to provide the key to your software security solution.

One thing I found interesting about that video you linked to is he doesn't address any tamper-evident solutions that would remain unknown. Consider how steganography works - the principle is you hide your safety mechanism. Think how perfect a tamper-evident tool would be if after tampering with your equipment, the attacker had no idea you would be able to tell. You might even be able to recover their hardware and determine who the perpetrator was.

Perhaps something like putting a human hair across a seal.

Answer 6

Is the computer system you talk about a workstation or a server ? The requirements for each one seem greatly different.

Regarding workstations, I think that laptops offers greater security than desktops. The keyboard being a physical part of the computer, plugging a key logger becomes a much more difficult task (however this does not protect against Tempest-like sniffing). Moreover, during out of office hours, the computer can be taken by the employee reducing the risk of malicious access (they can either be brought at home, but this requires a strong involvement from the users in the company's security policy, or stored in a safe in the company office).

For servers, since they need to remain up and running even while there is no one physically present in the server's room, I think that securing the servers leads to securing the room: badge access, presence detectors, surveillance camera. However, the fact that a server needs to remain up and running is also a strength since, would you have a thoughtful audit system, a server reboot or disconnection (or other kind of unusual behavior, hardware changes, usb key or media insertion, etc.) should leave evidences not easy to tamper with (ie. not stored in the same room...).

Sadly 100% security does not exists. But, while I read you talk about "cost effective and creative ideas for detecting physical attacks against computer", this reminds me of this funny technique in a movie where the "hacker" turned the wheels of his desktop chair in a certain position when leaving his apartment to detect any move of this chair during his absence (=> someone accessed his desktop and, most likely, his computer).

Answer 7

I think you're possibly aiming too high-tech.

Detecting attacks from outsiders:

Any physical security measure that relies on visual inspection after the fact is flawed.

An attacker can (with enough effort) produce a system that is visually indistinguishable from your current one, but is acting as a proxy to the real system (unopened, untampered) they have stored somewhere else (while monitoring all the communication).

So: the strongest (in fact, I would argue the only complete) method of physical protection for a computer is supervision - CCTV records, access control and security patrols. You then have the problem of securing your CCTV system from physical attacks - but this is (I assume) a problem that CCTV systems already tackle to some degree or another, at least in terms of detection.

Of course, once you have such a system, then you can make the problem of replicating the system (or altering it without leaving a trace) harder, by methods such as tamper-tape.

Detecting attacks from insiders:

Obviously, access control won't help you if your attacker is an insider to the organisation.

CCTV and security patrols will still be helpful, though. Ensuring that people in the organisation can always see roughly what other people are doing will help them self-police ("What's Jane doing to her computer?").

Regularly inspecting or even swapping-out cheap externals (e.g. keyboards/mice) would force any physical attack to happen to the larger components (e.g. computer tower), which would hopefully be more noticeable (and tamper-tape, etc. would also help you here). For a small organisation, selling all your old monitors on eBay and buying new ones might not cost that much (especially if you're also getting those ones second-hand).

A physical attack probably isn't the vector of choice for an "insider" anyway - unless we're talking about a server that they aren't meant to have access to (at which point, the "outsider" situation applies).