Slashdot Mirror

Security is a process, not an application. Nothing is completely secure - nor will it ever be.

It may not be an application, but I'd like the see the NSA, et al recover from one of these.

I jest, of course, but these things fascinate the little kid in me.

Oh, don't get me wrong, I'm combining my love for Alien and my inexplicable whoring for 'funny' upmods(that don't even net me the 'karma' I don't care about), rather than phoning in a reliable 'insightful' rant about THem Gummunit Union Beurocrats! in part because it amuses me more, and in part because (especially if your hardware is old shit) a sledgehammer is probably the best approach if you actually think that a state-caliber attacker is on your ass(for larger jobs consider a shredder rather than a hammer).

In this specificcase, given that their analysis found only a small quantity of chickenshit malware, and because the EDA is kind of a low-priority target for the really cool attacks, I strongly suspect that it was an overrreaction(and, if it wasn't an overreaction, doing more aggressive analysis, in order to better understand the adversary's capabilities, in terms of OS, Application, and hardware/firmware level malware would have been more responsible than just shredding it all).

That said, though, you'd be hard pressed to be paranoid enough about the potential for even seemingly innocuous devices, in the hands of a capable attacker, to be malicious. The BIOS has had slightly unnerving powers ever since SMM; but these days it's a second OS, more or less, USB devices are highly likely to be full, potentially reprogrammable, devices that are just implementing whatever they are supposed to be in software(OEM cost-cutting reduces the risk that there would be space/power to hide anything really cool; but some pretty weedy microcontrollers can handle being whatever flavor of USB slave device they are set to emulate. Even monitors get a full i2c bus for DDC, no idea how well your graphics driver, occupying its position of relative privilege within the system, watches that interface...

I would say that they screwed up, because if they genuinely suspected the worst, shredding the evidence rather than analyzing it is unhelpful in preventing future attacks, and if they didn't suspect the worst, dumping clean images on the systems and getting on with life would have been a lot cheaper; but it is true that, if you suspect a genuinely capable attacker, you are sufficiently fucked that just burning it with fire is probably the cheapest option...

Have you ever considered a blender/shredder showdown with the Watch it Shred folks at http://www.ssiworld.com/
You would probably have to take one of their machines apart to fit into a Blendtec, but will it blend?

An industrial shredder also seems to do a good job.

That may be true, but multiple passes are much more fun.
Also, shredders are quite amusing.

This site has hard drive shredding and a *lot* more:

  http://www.ssiworld.com/watch/watch-en.htm

One of the more impressive ones, I thought, was shredding a steel barrel full of concrete and another one shredding carpet.

Did anyone else notice that the drive got so hot that the head controller IC was completely de-soldered. Just goes to show that if you want a hard drive destroyed you should have it shredded.

http://www.ssiworld.com/watch/watch-en.htm

The best way to protect a supposedly cleaned hard drive against someone later trying to read the data is this or this.

I'm sure that anything capable of shredding a hard drive is very impressive to watch

It's interesting, anyway

At a Previous Place of Employment(tm), breaking the high-security hard drives into pieces was only the first part. We were then required to submit the pieces to inspection from some contractor, and then the best part of all: Watching him submit them to thermite. From what I remember, not only did it melt the platters to slag, it also messed with the magnetics of any pieces that happened to survive it.

Even with all of this, we weren't allowed to keep souvenirs of the process. :(

Will it blend?

It's too big to fit inside the blender. A better question is will it shred?

http://www.ssiworld.com/watch/watch-en.htm

And the video for the application in question...

A company called SSI has exactly what you need.

See: http://www.ssiworld.com/products/products3-en.htm

They even have impressive videos of their products in action. They can handle almost any input format you can imagine. CDs, DVDs -- they'll even handle Blu-Ray and HD-DVDs.

No, no, no THIS is how you destroy old disk drives (and entire computers). Other cool videos here. The steel drum one is quite the shocker.

No, no, no THIS is how you destroy old disk drives (and entire computers). Other cool videos here. The steel drum one is quite the shocker.

No, no, no THIS is how you destroy old disk drives (and entire computers). Other cool videos here. The steel drum one is quite the shocker.

Check these shredders out.

What you really need is something that can reduce a washing machine to thumb sized chunks in little more than a minute. Check out these hungry machines. SSI

This movie makes me cry like a girl...

There is a machine that is purpose-built for this job: the SSI Quad.

This industrial shredder can shred couches, refridgerators, or computers. It could probably erase your hard drive!