Intrusion Detection For Your PC Case 213
Anonymous Coward writes "Ryan du Bois, from genbukan security (aka red0x), has created a chassis intrusion detection system for your computer box: the actual physical case. He also wrote a paper describing three separate implementations of this CIDS system: Contacts, Pressure switchs, and a PLA (programmable microchip). Included in his paper are complete designs for the first two and a promise for the last to come soon. Definitely worth a read. The paper is available in many formats including
OpenOffice 1.0,
HTML ,
TEXT
and a Tarball of them all. You can also obtain the
signatures as well as his Automated Security Tools Project, of which this is a member."
Nothing New (Score:2, Informative)
Oh yeah, FIRST POST BIATCH.
Re:Arrogant Trolls Like You (Score:2)
2. you sure got all riled up huh?
3. you are pretty judgemental yourself.
4. how am I to know whether or not the incident was true and you were really bragging about it through your sig.
5. regardless of whether that lady was your mother or not - she is one calous bitch, regardless of the circumstances. and its sad that we have such shitty people in this world.
6. you'd lose the fight.
8. I am not a troll.
9. have a nice day!
This is new? (Score:1, Redundant)
Re:This is new? (Score:3, Interesting)
I remember reading about systems in old issues of PC Magazine or such where, if the case was opened incorrectly, something inside would explode and cover everything inside with paint, thus making the computer parts un-sellable on the reller's market. The crook would leave your box behind and you could still get at your HDD to recover your data.
This is news? (Score:5, Insightful)
I can't imagine someone cobbling together something that has existed forever is news...
Re:This is news? (Score:1)
Re:This is news? (Score:2)
Re:This is news? (Score:2)
Kintanon
Re:This is news? (Score:2)
Allah Bomb President!
*ahem*
Yeah, DIY is always cool, especially if you're the first to do it. If Mr. I-don't-want-anyone playing-inside-my-PC's-case isn't cool, could someone show me someone else (a geek, not an assraping corporation) who beat him to the punch, plz?
Re:This is news? (Score:3, Interesting)
If you want to see real CIDS, go talk to people who make and use military encryption devices. (shake some of them too hard and they electrically self-destruct -- they erase their tiny little brain.)
Re:This is news? (Score:2)
The device, or the people that use them?
Re:This is news? (Score:3, Funny)
Re:This is news? (Score:2, Funny)
I wouldn't recommend using one as a way to tamperproof your PC though. The radiation causes parity errors.
Tamper resistant? (Score:2)
We are talking about the case here-- an IDS is in a physically compromised environment-- how easy would it be for a knowledgable and determined attacker to reset, disable, or otherwise circumvent?
Compaq has had this... (Score:4, Interesting)
A special tool from compaq is required to defeat the lock...or a drill. But anyway, it can keep track of when the case is opened I believe.
I have seen, but never used the feature, so I don't know the specifics.
-Pete
But.... (Score:1)
Re:But.... (Score:2)
locks don't help when you got the side off and a fan pointing in on the processor.
Re:But.... (Score:2)
This is one of them corporate IT bigwig thingys where the extra expense of an ID system is only a small part of the cost of the overall system itself.
Re:But.... (Score:2)
there was no need for you to reply to that guy.
Re:But.... (Score:2)
Somedays, you just gotta point out that someone's being an idiot. It may be blindingly obvious, but hey, we're all bozos on this bus.
Interesting, but... (Score:1)
If you wanted to it wouldn't be incredibly difficult to wire up a contact to the inside of your PC case. Using that dry contact you could either trigger an alarm (audible or visual) or just write out a timestamp to a log.
Just imagine... Someone cracks open your PC and a 175Db alarm sounds. Seems like a good idea to me!
Re:Interesting, but... (Score:1)
Or just hook the PS to the case body...with a transformer to boost that 12V line up a tad...
Of course, you'd then fry the shit out of everything IN the case, but you'd know if it was opened!
Too much time on hands (Score:1)
Since when has anyone actually needed a security system on their case?
Re:Too much time on hands (Score:2)
Some years ago I was working as a tech in a university as a co-op student. I learned that there were semi-common problems for people to break open the blank 5.25" panels on the front of the cases and reach in and grab the RAM and CPU. And this was on boxes that where physically secured onto the desks.
This is one reason why security on system cases is necessary.
Every managed PC sold by a big name company has it (Score:1)
Compaq, Dell, IBM...they all tell you when someone's opened the case, removed memory, added hard drives, etc etc....
C'mon!
What a bunch of Rubes!... Goldberg, that is (Score:4, Insightful)
Re:What a bunch of Rubes!... Goldberg, that is (Score:1)
Does this tape interface to you computer?
Alerting the sys admin that the user in accounting has been opening their PC?
I remember when I worked at Best Buy, people would come in, with their WARRANTY VOID tape broken on their Packard Bells, and there's no way we could prove they opened their machine up and fucked it up....
Re:What a bunch of Rubes!... Goldberg, that is (Score:2)
robotic tape does
Moderation (Score:3, Insightful)
It's really too bad when the people running the site know less than the people reading it.
Twoflower
Re:Moderation (Score:2)
Since when did journalists know more about a topic than the majority of readers?
Re:Moderation (Score:1)
I've never heard/read anyone make that claim. Usually it is quite the opposite.
Re:Moderation (Score:1, Flamebait)
Below that, they should have a little disclaimer: Please leave all pretentious wanking at the door. You can pick it up when you leave. Thank you.
Most of us Karma Whores (I use the power of
Your mods would have been metamodded out of existence.
Jackass.
Re:Moderation (Score:2)
Re:Moderation (Score:2)
If you're Lord Omlette then I think the eggs should have been allowed to live!
graspee
Re:Moderation (Score:2)
It's so nice having four different formats.. (Score:1)
what I learned from the movies (Score:4, Funny)
Re:what I learned from the movies (Score:2)
Happens to me all the time. pesky spies
Re:what I learned from the movies (Score:1)
(note to those of you who don't get sarcasm - yes I know you can't see laser beams. But you can in the movies. That's my point. So you don't have to respond to say that you can't see laser beams. Thank you.)
More important things to worry about (Score:3, Insightful)
Why not just use a chain to the desk which locks the case shut? Then you're safe in both cases.
Re:More important things to worry about (Score:2)
Already Done (Score:1)
~slak
Classified Processing (Score:5, Interesting)
My bios supports it.. (Score:1)
Something more low-tech... (Score:3, Interesting)
Howsabout a good old fashioned thieves knot [rcarchive.com]?
Re:Something more low-tech... (Score:2)
How is this secure? (Score:2)
I'd feel better will tamper-evident tape, but maybe I don't understand this system.
Re:How is this secure? (Score:1)
If the intruder is smart enough to know how to do this, they will go after big corporate targets with expensive boxen, and not your personal machine.
i'm thinking... (Score:1)
Re:i'm thinking... (Score:2)
Slashdot requires you to wait 20 seconds between hitting 'reply' and submitting a comment.
It's been 19 seconds since you hit 'reply'!
Nothing new (Score:2)
This guy is writing like it's news or something. I read the brief file, and it looks like he just figured out what I first saw years ago.
And also, the classic phrase:
if you don't have physical security, you have no security at all.
'hackers' chastity belt (Score:3, Funny)
Re:'hackers' chastity belt (Score:3, Funny)
They cared for it, they made it beautiful, they rode it, they rode it, they rode it...
This comment on chastity belts brings back to light the much debated issue of the hacker's liaison with his computer. He cares for it, makes it beautiful (case mods), sometimes prefers it naked (no case), install the latest software (XP) and then it crashes and he gets screwed, screwed, screwed...
I guess if they had porn on bikes we'd never had gotten this far.
Air pressure (Score:1)
since the pressure inside is unknown it would be nearly impossible (depending on the sensitivity of the pressure sensor) to put the case in a pressured box with exactly the same pressure.
any reasons why this is an impossible or crazy thing to do ??
Re:Air pressure (Score:1)
Umm.. well short of a water cooling solution you're going to have serious cooling issues trying this..
Re:Air pressure (Score:1)
Re:Air pressure (Score:5, Funny)
Ah! You have issued the rallying cry of the
"It sounds interesting yet totally impractical! To arms, my brothers! Let us mod this case!"
graspee
Re:Air pressure (Score:2)
Re:Air pressure (Score:2)
My idea would be light sensors in the machine. Open the case, flood it with light, hear a siren (send a signal.)
News from an AC (Score:1)
Re:News from an AC (Score:3, Informative)
I suggest you search through the archives of "Ask Slashdot." You'll find many interesting stories where it is clear that if the poster's identity was given away, they would be in trouble with their boss/clients.
Technology Sectors that are Hot or Heating Up Now? [slashdot.org]
Is it Wrong to Accept an Employment Counter-Offer? [slashdot.org]
Technology for Undercover Journalists? [slashdot.org]
Convincing Management of Network Security Issues? [slashdot.org]
Headhunting Laws? [slashdot.org]
And more ...
i wonder how long... (Score:1)
My IDS... (Score:5, Funny)
prevention? (Score:2)
-ks
simple enough (Score:1)
Medeco locks / tamper evident cases (Score:2)
IBM used to (and I imagine still does) build thier rs/6000 cases this way. The thing that always pleased me most was the use of a Medeco biaxial lock & key. Medeco's are effectively not pickable, in contrast to virtually all other pin-tumbler locks.
I don't know what other vendors use this or similar methods for the cases. the usual 3-4 pin lock incorporated in all the other cases I've seen (including some pretty expensive ones from Compaq / HP) were trivial to open. Even the use of mushroom pins is not going to be proof against a reasonably skilled intruder.
Nothing New... (Score:1)
Great intrusion detection (Score:5, Funny)
Identify intrusion by the stain on the floor.
For bonus points, replace the fake grenade with a real one.
Dell had it (Score:1)
Umm mine did this years ago (Score:1)
power off (Score:1)
Ala James Bond in Dr. No (Score:2)
Take a single hair, wet it in your mouth, and place it across the crack between the removable side panel and the rest of the case. Anyone trying to break in will not see a single hair - or think anything of it if they do - and you'll know whether someone has cracked it open.
And it costs nothing.
G4 Towers (Score:3, Informative)
I like the system that Apple has put into their G4 Towers. There's a spring-loaded clip with a hole in it that pulls out of the back of the case. You can slip a cable/padlock/whatever through this which prevents the clip from springing back into the case.
When the clip is out, the EZ-flip-down-door on the side of the case is locked, preventing unnoticable intrusion.
Fiber trip (Score:2)
Two Words (Score:1)
if its not removed they can't get the case open
...
its a lot cheaper and simplar then this system...
Useless, useless, useless (Score:5, Insightful)
So what we have here is some fourteen year old with his own "security" organization, a metric buttload of super glue and an utter lack of clue who writes a frankly useless article so that he can pretend he's important whilst slinging around big acronyms like "PLA" and "VHDL" when the tools they represent are useless to the task at hand. In other words, a snake-oil salesman.
-jhp, smacking down dim-bulbs everywhere
Re:Useless, useless, useless (Score:1)
Re:Useless, useless, useless (Score:2)
The only reason to add logic would be to latch an intrusion during power-off. But, I suspect that the motherboard already does that (could be wrong-that's the obvious question he should have answered).
Re:Useless, useless, useless (Score:2)
Well, why are you whining about it here instead of writing to the author, slackass?
Because it's very likely that the author, like most snake oil vendors, is not smart enough to understand how stupid he is?
It's pointless to tell those kinds of idiots anything, but there is value in warning others who might be taken in.
Security Through Alternativity (Score:1)
Now that the world is shook up by the news of hackers breaking into PC towers and desktops, I'm happy I have a laptop.
Now let's hope my manufacturer fixes any holes in my laptop as quickly as the Apache people came up with their patch...
This is news?!? (Score:1)
I figured there would be something more interesting, like creating a whole subsystem that could figure out what more than just "case open". I figured there'd be something like using the serial port to talk to this system, and perhaps using the mb connection to let it know that there was an event to look into. HOW disappointing!
Nothing new here! (Score:2)
Damn. This must be a slow news day if I can't be entertained by a a description of what is involved. No siree, I wouldn't want to learn anything. If Compaq and Dell can build stuff into their systems that sounds the same, then it isn't worth me knowing about. Hmm my computer doesn't have one of these. I guess I never thought about that when I built my own computer. Pity, I don't have an intrusion detection system.
Oh I know, I don't need one! My friends all shout 'First Post!'.
Re:Nothing new here! (Score:2)
common. (Score:1)
and more recently motherboards comming with jumpers/connectors for such intrustion dection switches on the case.
not really much news hear.
maybe if he did something cool with his like make it shock the hell out of who ever was attempting to access the case with out authorization.
what's it good for? (Score:2)
If a thief breaks into your computer room they're going to hit the power switch. Then, if they don't carry away the entire computer, they'll open it up and remove what they want. AFTER the CIDS has been power disabled.
This kind of sucks... (Score:1)
So Basically... (Score:3, Insightful)
If you can't tell from all the other posts, this has been implemented for a great number of years on nearly all business-grade desktops, usually accompanied by a provision for a physical lock.
If this kid actually gets someone to buy into this and pay him to license his "software", I've gotta give him at least a little respect. At least he's not the one paying for it.
--Ribald
Re:So Basically... (Score:2)
Don't worry, Microsoft already takes care of this. (Score:1, Funny)
1) If someone breaks in and doesn't change anything inside, you don't care.
2) If someone DOES break in and change anything in the hardware configuration, Windows XP will think it is no longer running on the same computer and stop working until you contact Microsoft for a new activation key.
"Electric Fence" solution (Score:1)
"Geeks!" she exclaimed, "...all they ever think about is hex!"
The REAL reason for intrusion detection... (Score:1)
This gets filed under "security"? (Score:2)
People keep abusing my profession, next time I tell them I'm a security expert they're going to ask me if I can please go and close the door...
It's heartening to see ... (Score:2)
Though I'd still prefer that LaTeX was the standard document distribution format, but then I'm a die-hard
It gets better (Score:3, Interesting)
So, beyond the dubious importance of this "design" - which begins with setting up copper contacts on the case and moving on to pressure switches - he can't give us any results because he doesn't have a utility to check the register.
That's classic.
Two bits says this made it to the front page because he mentions he's running linux on his "CIDS."
Why is this even here? (Score:2)
Why not just buy (Score:2, Interesting)
I applaud the efforts of junior MacGyvers, but if you really want to be secure, there are obviously better solutions.
Speaking of computer security, that reminds me of the time when the CS department at the University I went to got a bunch of brand new lab machines. They all had intrusion detection, which we CS dept. admins thought was pretty cool. We told the campuswide IT guys that we needed them secured in place. They dragged their feet on it. A month later, the CS department threw a Lan party in the same building (though not in the same room) and some enterprising students used it to cover the theft of 4 of the new lab machines. Security wire and cameras were in the room within a week. As far as I know the stolen computers were never recovered. We took small solace in the knowledge that the computer beeps at them and displays a brief annoyance message now before booting the OS. That is, as long as they opened the case and didn't flash the BIOS.
Bond (Score:2)
Another option (Score:4, Interesting)
We used a home security alarm system modified to connect to the computers. We mounted a switch inside the case that would open when the case was opened. We put the correct resistor in series with the switch (home security alarms don't just measure continuity, the also measure resistance) and connected it to a RJ45 jack on a blank slot cover. We mounted a plate to the monitors either by replacing a screw with a security screw kit (you can't remove the screw without removing the cable run through it) or using industrial super glue. Loop the security alarm cable through the monitor plate and the lock hole on the back of most computers, connect it the RJ45 jack and arm the alarm. If someone disconnects the cable or opens the case, a 125db alarm sounds in the room and an automatic call is placed to the campus police.
locking seals (Score:2, Informative)
delusions of grandeur (Score:2)