352K views · Oct 27, 2011 · 52:43 · 1 HN recommender · 3 mentions · discussed 2015–2023
A DEF CON 19 talk by datagram introducing tamper-evident devices. It reviews how seals and similar products are designed and shows that they are often easily defeated, drawing on the DEF CON tamper-evident contest.
Why Hacker News points people here: HN points to it in threads about physical security and tamper-evident seals as an informative look at how easily they are bypassed.
“is interesting to watch”HN comment, 2015
“is interesting to watch”
DEF CON intro to tamper-evident devices and how easily they are bypassed.
unfortunately several of these professional seals are only a bit more obscure, but not much harder to open than a zip tie. Introduction to Tamper Evident Devices from datagram at defcon 19 this video is interesting to watch
“Like the computer world, many of these devices are overmarketed”
DEF CON tamper-evident contest where all devices were defeated.
> A company makes security seals for this very purpose and markets them under the name "TamperTell". They have a serial number on them and a matching receipt tab that you remove before flight then check against on arrival. I wouldn't put too much trust into the marketing of products like this. Time and time again they fail to protect against the most basic of "lockpicking", and unless I've seen multiple skilled people failing at unlocking the "TamperTell", I'd put it in the same bucket as the rest. > DEF CON 18 (2010) held the first ever "Tamper Evident" contest, where contestants were given a box sealed with a variety of tamper evident devices, many of which purport to be "tamper proof." All of these devices were defeated, even by those with little experience and a limited toolkit. Like the computer world, many of these devices are overmarketed this video
Linked in discussion of tamper-evident seals on hardware.
Assuming this was done at the government's request, I assume Hetzner is more than willing to comply with a court order mandating they allow them to monitor and physically size a machine. And outside of nation-state requests, even ignoring the fact that someone could probably pay-off an employee, I think ease would depend a lot on the datacenter and target; judging by the awesome and hilarious story behind the Fremont Cabal accidentally becoming an internet exchange by essentially having some dude barely secretly slipping unauthorized cables into the raceways [1], I figure there are a lot of places where if your target is simply renting a couple rack units or single rack rather than an entire locked cage, you can probably get physical access by doing the same. Also, a lot of Deviant Ollam's stories about industrial security and the dozens of ways he's broken into utility companies, server rooms, etc — mostly just by being confident, looking the part, bad doors [2], and badge cloning [3] — don't give me a ton of confidence that someone with skill couldn't feasibly either get direct access to servers they shouldn't, or at the very least, access to an important part of the supply chain for their target. And speaking of supply chain, my processor died recently, so I ordered a brand-new in box replacement Ryzen, and when it arrived last night, out of curiosity, I wanted to see if I could get the CPU out of the box without breaking the tamper-evident authenticity seal... ... and abo
