This Laptop Will Self-Destruct

call -151 writes: "Interesting article at wired about how since 1997, 205 laptops have disappeared from the British Defense Ministry most with classified info. Oops, left my laptop on the bus... So now the plan is to have ``a built-in electronic self-destruct mechanism that erases a laptop's hard drive if the case is opened by force'' when the code is forgotten, as well as ''a tracking feature that allows a computer gone astray to call home." Maybe we'll see some of this tech trickle down to other interesting uses ..." Maybe vigilante justice in the future will consist of LoJacked laptops allowed to be stolen, with the Semtex inside blown up via 802.11. Hey -- business method patent ...

Comments

I'm sure they already have this

[Anonymous Coward]

now the plan is to have ``a built-in electronic self-destruct mechanism that erases a laptop's hard drive

Windows?

Re:I'm sure they already have this

[BorgDrone]

No, the idea is that they can determine when it has to self-destruct, windows destructs your PC at random times.
---

Re:I'm sure they already have this

[Anonymous Coward]

Please, I posted this looking for a few laughs, but +3 Funny is way off-target. I'd like a few Insightful, Overrated, Troll, and Flamebait mods please. Thank you.

Self Destruct Features in HW

[Greyfox]

Oddly enough, about a year ago I suggested wiring the embedded device we were working on with thermite so that if one of those wise-ass kids in Sweden tried to hack our hardware, it'd quitely fry the motherboard and hard drive. Of course, they'd have to be careful about the amount. It's kinda bad PR if the wise-ass kid loses an arm in the deal. I'd call that a feature rather than a bug though (It certainly would discourage hardware hacking.)

In retrospect I should have patented the idea. I could probably get some decent royalties from assorted intelligence agencies around the world.

If you're from one of aforementioned intelligence agencies, there are lots more ideas where that came from hint hint...

Re:Self Destruct Features in HW

[blair1q]

Prior art (maybe):

Long ago (10 years?) it was reported (rumored?) that the NSA (who have their own fabs) uses microcircuits encapsulated in packages that destroy the chip (chemically? thermochemically?) if any attempt is made to pop the lid to examine it.

Commercial fabs used to pot the chip in a material that could only be dissolved by acids that will also eat the device.

--Blair

Re:Self Destruct Features in HW

[UltraBot2K1]

How the fuck is this interesting? If someone hacks your computer, the worst thing that could happen is you'd lose some data and have to do a fresh install of everything. If you put fucking thermite in a PC, you're out $2000 worth of hardware. The solution is worse than the problem. It's like saying "I don't want to get robbed, so I'll just blow up everything I own"

Re:Self Destruct Features in HW

[Tech187]

Well, if it kills or maims the thief at least there's redeeming social value.

Re:Self Destruct Features in HW

[Pig Hogger]

Long ago (10 years?) it was reported (rumored?) that the NSA (who have their own fabs) uses microcircuits encapsulated in packages that destroy the chip (chemically? thermochemically?) if any attempt is made to pop the lid to examine it.

I remember, some 20 years ago, thinking about building a blue-box on a breadboard with springs under the chips, all secured with a lid. When you open the lid, to see what's in it, pop goes the chips and an investigator would be at a loss in determining the true purpose of the widget...

--

Re:Self Destruct Features in HW

[KioNeo]

That would be a valid argument if the data was not of a sensitive and/or confidential nature.

Re:Self Destruct Features in HW

[biglig2]

Er... the point is not that your computer is hacked, but that it has been physically stolen?

Re:Self Destruct Features in HW

[Mike1024]

Hey.

If someone hacks your computer, the worst thing that could happen is you'd lose some data and have to do a fresh install of everything. If you put fucking thermite in a PC, you're out $2000 worth of hardware.

If we look at the original post (emphasis mine):

about a year ago I suggested wiring the embedded device we were working on with thermite so that if one of those wise-ass kids in Sweden tried to hack our hardware, it'd quitely fry the motherboard and hard drive.

An embedded device isn't a desktop computer or a server. It's a proessor that's 'embedded' in another device. Take a TiVo for instance. It is an embedded device. The original poster's usage of the term 'hack' was not as in crack but as in 'classic' hacking.

The definition is important. If I was to crack a server, I would be breaking in and acessing data without authorisation. If I were to hack an embedded device, I could for example add more recording time to my TiVo.

Some companies are annoyed by peope hacking thier embedded hardware, since they can but low-spec versions and make them into high-spec versions.

The original poster was likely making a joke. He proposed a device that if you opened the case to upgrade it, would destroy itself.

It's funny. Laugh.

Michael

...another comment from Michael Tandy.

ThinkPad?

[phossie]

two layers of security, and i'm pretty sure i heard something somewhere (ooh, specifics) about there being some kind of secure thinkpad - here, check this link to google's cache - but, unmentioned there, i thought there was some kind of tracking device enabled in a somewhat standard way.

anyway... this just doesn't sound all that "new"...

Re:ThinkPad?

[ozbon]

I know here in the UK that Fujitsu-Siemens do their Lifebook E6560 in a secure version...

"if" opened by force...

[thrillbert]

Okay, so just make sure you got your tools before you proceed to disassemble #5..

Or is the British government saying "All your tools are belong to us!" ??

A less dangerous method...

[JohnnyKnoxville]

might be to implant electrodes in the people who have laptops, then when the get too far away from them, the receeive severe electrical shocks.That would learn 'em real good, real fast. Then the poor sap who finds the laptop in the back of the cab doesn't get his fingers blown off.

Re:A less dangerous method...

[BradleyUffner]

Yeah, he just gets electricuted once the cab gets too far away. :)
=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\ =\=\

"if" opened by force...

[thrillbert]

Okay, so just make sure you got your tools before you proceed to disassemble #5..

Or is the British government saying "All your tools are belong to us!" ??

Quit giving them laptops!

[EvilStein]

That way they won't lose important stuff. :P
205 laptops going missing (even if it is since 1997) is still a rather alarming number, considering their contents.
Maybe they should chain them to the owners. :)

Re:Quit giving them laptops!

[Meech]

A local high school that gave 3000 students laptops just reported that none were missing and 12 were damaged. These are just punk high school students. How is it that they can keep track of such things, but government officials can't! I mean as an excuse the students can say "my computer was stolen, so I don't have my homework!"
What the does the official say? "I am a huge jack-ass and left my computer on a bus."

Re:Quit giving them laptops!

[Meech]

Actually, the point was that high school students can take care of equipment better than the employees of the British government.
The fact that porn or a term paper is not as important as classified material makes the case even stronger.

Re:Quit giving them laptops!

[Meech]

British intelligence officers have developed a rather worrying tendency of forgetting that they are carrying a computer, leaving a trail littered with lost laptops. The British Defense Ministry has reported 205 laptops missing since 1997 -- most of which contained classified information. That's an average of 51 lost laptops per year.

Right from the article. Which word do you see more, lost or stolen? Do you get off on writing inane shit when you haven't read the fucking article?

Re:Quit giving them laptops!

[ReidMaynard]

The difference is:

1) In the UK, the lappys were still government property, and the easiest way to make them personal property is to "loose" them.

2) while the students were "given" the laptops; why "loose" something you don't haveto give back.

I've seen this type of loss a lot in corporate america, why should the UK be any different.

btw - when lappys get too old/slow, their owners get very clumsy.."I was working on my balcony and the damn thing dropped 30 feet onto the concrete", returning the pieces in a plastic WallMart bag.

Make them accountable..

[RAruler]

Its all fine and dandy that you can blow up a laptop, but thats expensive. Make the people pay for the lost equipment. Me, i'd make damn sure that I didn't leave behind a laptop worth $6,000 dollars. Or, have like a wristwatch that transmits a signal, and if you get say, 20 metres away from your laptop it goes off. An ounce of prevention beats uhh.. a lot of cure? Anyways, the idea that a laptop could self destruct is always nice, keep the data on it encrypted for added security.

---

The Elite Intelligence Officers

[mike_the_kid]

That leave their laptop in a bar after getting drunk.

Thieves have been blamed for some of the laptop losses, but the majority of the missing machines were simply mislaid by tipsy or distracted agents.

Kind of makes you wonder just how hard it is to get a job as an international spy. Maybe the really good spys are the ones who go to the bar, get some agent a few drinks, maybe with some GHB alongside, and then the next morning:
Wha'appened?
Why are you even taking the laptop with the bomb plans to the bar? Do they have weapons grade drink recipes on the same hard drive?

This might suck...

[DA_MAN_DA_MYTH]

Imagine a boss who wants to avoid confrontation presses a button, nothing says fired like blown off hands and a charred face...

Rehab is for quitters...

Uh..

[c_g12]

The Ministry did not respond immediately to a request for comment, but said in a press release that it plans to protect its laptops by purchasing 15,000 thief-proof briefcases, each priced at 1,000 pounds apiece (about $1,438).

They may want to consider attaching 15,000 handcuffs at 2 pounds apiece.

The tradition of Empire.

[euroderf]

One thing that seems to bemuse foreigners about Britain is the fact that the Kingdom punches above its weight in international affairs.

One of the main reasons for this is the historical tradition in Britain to rule over peoples and waves, since the days of William the Conqueror. The British have always had a caste system based on gearing the country to wage war, and to rule other countries. The British upper classes are bred to lead over others, even genetically speaking this can be seen - every president of America has been of stout Anglo Saxon extraction.

The result of all this is that the British can exert huge influence abroad, and even today the pax Britannica continues, through our proxies, the Americans, who inherited their ideals from us.

The shining light of Celtic inventiveness and Anglo Saxon ruling and liberty has meant that every corner of the globe has had the values of liberty and democracy enforced upon it. America would not exist were it not for the Mother country.

The secret services are trusted by the British people, as they are composed of boarding school, cricket playing chaps who have been steeped in playing 'the game' since childhood. This tradition is why Britain was aware of the Soviet threat before america, and managed to convince america to join us against the Soviets. Same with Hitler - the Americans were to scared, and thought he was no threat. But Britain nobly stood alone.

In this laptop, we see the traditions of Old England and Empire distilled to a pure essence : Trust noone, treat all fairly and always some first - tho' 'tis no shame to come second, something that our American children have perhaps forgotten.
--

Re:The tradition of Empire.

[mike_the_kid]

Hey, I'm not dissing the British, but these born and bred leaders must be too busy waging war in the name of the queen to remember the little things, like laptops.

Same with Hitler - the Americans were to scared, and thought he was no threat. But Britain nobly stood alone.

No doubt I'm asking for trouble here, but for every Churchill there's a Chamberlain.

Anyways, if you want to know more about the British elite's, read Rainbox Six by Tom Clancy. Clancy adores the Brits. Rainbow is a fiction based on the very laptop losers (believe me, they are quite impressive, really). Excellent insight into intelligence ops, and concurs with what 've read about Delta Force (the American counterpart to the British Special Air Services) from Charlie Beckwith.

Re:The tradition of Empire.

[isomeme]

Same with Hitler - the Americans were to scared, and thought he was no threat. But Britain nobly stood alone.

Oh, please. I am of British heritage and this made me laugh out loud. Recall that England's noble stand of 1940-41 was made possible by England's pathetic capitulation to Hitler just two years earlier. And Neville Chamberlain was a Rugby graduate, too.

--

Re:The tradition of Empire.

[Amanset]

First a discliamer: I am British.

Same with Hitler - the Americans were to scared, and thought he was no threat. But Britain nobly stood alone.

I am sure France, Australia and New Zealand will take exception to this. Those three countries, along with Britain, declared war on Germany on September 3, 1939. Incidentally, two days later the US declared neutrality and wouldn't join the war for over 2 years.

One of the main reasons for this is the historical tradition in Britain to rule over peoples and waves, since the days of William the Conqueror.

But wasn't William the Conqueror French? Hence the name "The Conqueror" - he conquered England. Surely a better were argument would be that, as one of the most invaded countries of Europe (France, Germany, Italy, Scandinavia .... the only ones we really stopped were the Spanish), Britain decided enough was enough, she was no longer going to take this anymore and decided to do some invading for herself?

Re:The tradition of Empire.

[The-Pheon]

Britian knew the threat of Hitler and did nothing to stop it. Appeasment you called it!

Own up to your own faults. You can lose a laptop as easily as any other nationality.

Re:The tradition of Empire.

[KilljoyAZ]

An elegant troll. He gets the history right enough to fool the moderators who fell asleep during high school European History class, but is still wrong enough to be, well, wrong.

Fortunately for us, all you need to do is say the magic words Neville Chamberlain and this troll crumbles to dust.

Re:The tradition of Empire.

[Pig Hogger]

Chic! Des romains!

One thing that seems to bemuse foreigners about Britain is the fact that the Kingdom punches above its weight in international affairs.

Quite not. The britshit are totally decadent. And they are one of the most hated people on earth.

One of the main reasons for this is the historical tradition in Britain to rule over peoples and waves, since the days of William the Conqueror. The British have always had a caste system based on gearing the country to wage war, and to rule other countries. The British upper classes are bred to lead over others, even genetically speaking this can be seen - every president of America has been of stout Anglo Saxon extraction.

The britshit ruled other lands because they depleted the meager natural ressources on their puny island. They had no other choice but develop the skills, laws and institution that allowd them to rape, plunder and pillage the whole world.

Did you know that once, you used to be able to purchase a piracy license, hire a crew, and legally go on the high seas and plunder and pillage non-britshit ships?

The result of all this is that the British can exert huge influence abroad, and even today the pax Britannica continues, through our proxies, the Americans, who inherited their ideals from us.

Some pax! Just a heavy navy that went all over the place, and whenever a britshit merchant wasn't able to pillage and plunder to his content, they simply bombarded the shit out of the place that had the guts to say no to some britshit swindler.

And to meddle in European affairs by instillating wars between the countries to insure that no one would turn against the britshit. One will remember Neville Chamberlain's accommodation with Hitler, which allowed the latter fucker to plunder Europe unmolested until it was almost too late!

The shining light of Celtic inventiveness and Anglo Saxon ruling and liberty has meant that every corner of the globe has had the values of liberty and democracy enforced upon it. America would not exist were it not for the Mother country.

Anglo saxon "liberty" is only affordable to the richer, those who are able to afford armies (of lawyers or soldiers - some britshit croporations used to have their own private armies) to defend their own liberty, at the expense of others, of course (like Mc Donald's bludgeoning critics to death by suing them for slander).

The secret services are trusted by the British people, as they are composed of boarding school, cricket playing chaps who have been steeped in playing 'the game' since childhood. This tradition is why Britain was aware of the Soviet threat before america, and managed to convince america to join us against the Soviets. Same with Hitler - the Americans were to scared, and thought he was no threat. But Britain nobly stood alone.

Those boarding school cricket players are the epitome of britshit incompetence, as exemplified with the incompetent family-compact, which was unable to keep their empire at the end of the war. And the britshit appeased Hitler to the end, so talk about shitting in one's pants!!!

In this laptop, we see the traditions of Old England and Empire distilled to a pure essence : Trust noone, treat all fairly and always some first - tho' 'tis no shame to come second, something that our American children have perhaps forgotten.

Come second to last as it comes to intelligence and smartness, indeed.

--

Re:The tradition of Empire.

[travisdaye]

The British aren't ruled by the upper classes- the 'caste system' has almost disappeared, and the cabinet isn't all from Oxbridge, isn't all from a privileged background and John Major, the last Prime Minister and son of a circus performer, made his career from standing on soap boxes. Most people are middle class. Hugh Grant is as representative as Captain America.

The Secret Services have come under a lot of scrutiny following memoirs and a budget that has been rocketing despite the end of the Cold War. Read the papers. Despite a resurgence we're terrible at Cricket because it's not getting played very much any more- even in boarding schools it's usually third to Football and Rugby.

The British Government has a nasty habit of acquiescing to America, particularly when the Americans want to bomb someone. As a Nation we tend to follow where the EU or the USA leads.

Laptops belonging to MI5 have fuck all to do with British 'Old England' 'Empire' tradition beyond people getting drunk and looking foolish.

Re:The tradition of Empire.

[wobblie]

anyone else see that great movie, "The Ruling Class?"

--

Re:The tradition of Empire.

[aethera]

You know,my grandfather was an Iirishman in the truest sense of the word. He used to say, "Sure the sun ne'er sets on the British Empire.... but that's because God wouldna trust 'em in the dark."

missing laptop

[Diplomat73]

Yahoo has the story about the "missing" laptop here . It seems that A Defence Ministry laptop computer packed with national security secrets had gone missing after an official left it in the back of a taxi. The official had notified police about the missing laptop but nothing has come out of it. Anyway as the story said this is not the first time: In March last year there were reports that agents of MI5, the domestic security service, and MI6, the overseas security service, had lost laptops containing secret information.

Powerbook 5300 Hindenbook

[nwonknu]

I had an Apple Powerbook 5300cs (code name: Hindenbook) that already had this self-distruct technology years ago.

Interesting idea.

[Restil]

It would sure help make people honest. Sure, that laptop you're illegally pilfering is probably not rigged to explode in your face... but how can you be sure? Best to just leave it exactly where you found it.

And you could extend this to other items as well. Every retail shop could come equipped with one or several decoy items, so if the place gets ransacked, the thieves would either be trackable, or better yet, you could detonate the payload, either something destructive, or something the equivalant to a dyepack.

-Restil

Re:Kaboom!

[Guppy06]

No no no, the proper WarCraft II quote is "WE'VE got explosives!" Or "Bombs are great!"

This LapTop will.....

[Peridriga]

Dear User, This overpriced, bullet-proof, government owned, classified computer will self-destruct in 30 seconds if you do not uninstall Windows from me.....

--- My Karma is bigger than your...
------ This sentence no verb

hmm

[vinnythenose]

could definitely use the calling home feature for my keys... Now where were they last??

/. slow again

[Paelon]

Does /. have some rule against linking to other tech news sites? This was posted on Ars Technica about an hour and 15 minutes before /.

Blah.

And Dr. Wang Just lost a tape!

[KarmaBlackballed]

What is it the Chinese PhD at LosAlamos (USA) lost --- one tape? Said he threw it away or something? All hell broke lose, and he went to jail. (For a short while.)

I think three state department computers have been lost in the last 5 years. That has been a terrific stink too. All over the news about a year ago.

If branch of the US government lost anything close to 205 laptops with secret information, there would be hell to pay.

(Goodbye karma) Maybe UK has much lower standards for security?


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ the real world is much simpler ~~

i Spy

[deran9ed]

Hopefully the agents who are losing their laptops aren't doing anything super secretive, lord knows if they lose a typical laptop, imagine what could happen with some super secretive 2inch chip ;\

To combat this spate of missing-in-action machines, the Defense Ministry plans to outfit their absent-minded workers with secret-agent-style briefcases that protect national secrets by automatically destroying the contents of lost laptops' hard drives.

Shit I could write them a script to do this after three failed attempts, and securely wipe their data beyond comprehension. What they should do is give those agents time off with a suspension, ultimately leading to being fired for incompetence and negligence.

Odd that an MI6 agent would be out bar hopping with her laptop. I know the UK is a bit more relaxed then we are out here in the US, however I still can't grasp losing a laptop, let alone going to a bar with a laptop that had gov secrets on it if I intended to get hammered.

Maybe their government should look into a biometrics fingerprint based system which wipes a laptop on a failed attempt.

By purchasing something like some super elite case, I'm sure those laptops which were stolen will be easier to target the next time around.

privacy for the masses

try rubber hose

[bluelip]

Maybe the should implement a rubber hose type filesystem.

The site is www.rubberhose.org for the goatse.cx fearing.

Blah.. Malarky, All of it..

[The Critisizer]

You'd never see Jimmy Bond, 007 lose his laptop. Bah. It's all malarky.

Re:Blah.. Malarky, All of it..

[cosmo7]

Q: and try to bring it back in one piece, 007.

Bond: Yesh, Q.

Business Patent...

[Hecatonchires]

Don't use semtex, that would be to specific. It would limit you later.

"a method whereby electronic devices have specially designed cavities that are packed with an explosive agent that can be triggered by a specially coded transmission or by a switch that is activated when it detects intrusive force."

All those goddamn cameras, and THIS?

[Tackhead]

Lemme get this straight.

We have cameras covering every square inch of Britain so that every individual can be tracked.

But we can't tell you where Agent 69 was last Tuesday when he lost his laptop.

And it's a good thing we've got these cameras to keep track of the IRA, or they'd set up us the bomb.

So we'll give each agent a small thermite bomb in a briefcase instead, and give 'em free roam of the city.

The fuck-up fairy must be workin' overtime.

Re:All those goddamn cameras, and THIS?

[Mike1024]

Hey.

We have cameras covering every square inch of Britain so that every individual can be tracked.

Actually, no. Cameras are rarely placed anywhere that doesn't have a fairly high risk of crime. In the center of the shopping district in a city yes, there may be cameras. But not in suburban housing areas, et cetera. That would be stupid.

But we can't tell you where Agent 69 was last Tuesday when he lost his laptop.

Unfortunately, most cameras are on the street, i.e. where a lot of street crime is committed, not in the back of taxis, or behind bars. In any case, the resources required to track any person using security cameras would be massive. Whenever they entered a covered area, there would be a risk of them not being picked up again. Have you ever tried to identify someone from a fuzzy, black-and-white security camera? It is sometimes difficult.

And it's a good thing we've got these cameras to keep track of the IRA, or they'd set up us the bomb.

Can't live with them, can't legally torture them to death...

So we'll give each agent a small thermite bomb in a briefcase instead, and give 'em free roam of the city.

If we look at the article:

the Defense Ministry plans to outfit their absent-minded workers with secret-agent-style briefcases that protect national secrets by automatically destroying the contents of lost laptops' hard drives.

I very much doubt Thermite would be involved. Why not just make a thin iron lining for the briefcase, then take it out and wrap a thin wire around it, say, 10,000 times, then connect it to some capacitors and a battery inside? If you open the case without entering the code, the (ready-charged, of course) capacitors burst-discharge, like a camera flash, into the wire coil with the iron center, and the laptop in it. As those of you who were awake in first year high school physics may have guessed, you have a big electromagnet, with your computer inside is, recieving a big burst of voltage. This would generate a substantial magnetic field. Since hard disks are written to magnetically, Bang! All the data is erased.

That would be far safer and similarly effective.

But why they don't just encrypt the hard disks is beyond me.

Michael

...another comment from Michael Tandy.

What is the freaking obsession with laptops?

[Restil]

Is it because its more trendy than a desktop or something? Even if this is the case, who cares? Why does the intellegence community need them? If data is sensitive, even in the slightest, it shouldn't EVER be in a position that it could be accidently LEFT LYING AROUND SOMEWHERE! It should remain confined within a secure guarded perimeter. Even when kept internally it is subject to potential security breaches, networks can be cracked, spies can smuggle out information, etc, but at least thats a far cry than being able to just pick up a 4 pound object and walk away with it and spend all the time you need trying to figure out what you have.

Besides this reason, laptops are fragile, expensive, and rarely contain many user servicable parts. Even if you were going to set up a system in a public environment, would you prefer your potential thief to be forced to lug around 40+ pounds of bulky equipment or be able to slide 4 pounds worth of equipment into a backpack and walk away?

-Restil

Re:What is the freaking obsession with laptops?

[mako]

Most of the "classified" information was probably classified out of convenience. These big bureaucracies classify everything.

Even if the information was important it would seem like they would have something like rubberhose crypto for just such contingencies.

But, no let's not have reasonable classification procedures, or use ready made tools, let's spend money on more crap like Super Sekrit Briefcases . Love that groupthink.

MI5 becomes most wanted bombers in UK

[JohnTheFisherman]

...a built-in electronic self-destruct mechanism...

Suddenly, the MI5 becomes a bigger bombing threat than the IRA.

it would make more sense..

[fjordboy]

wouldn't it make more sense to make a program that automatically does a low-level format through a phonecall or something? It could be made into the firmware...so it couldn't be deleted by whoever stole/borrowed/found the computer...i think that would be a little better and safer than an explosive computer....

I think the techies just want an excuse to play with fire though...

Laptop Security

[Kalak]

This is far from a 007 device.

If I attached one of these to my laptop case, hacked it's alarm to a big electromagnet hooked to the drive, or something else appropriate, then the self destruct effect should be possible. All this from "consumer" parts. A proximity detector is also possible, but I just don't recall where to find one.

Encryption...

[hpa]

It seems it would be a lot cheaper, and probably more secure, to just encrypt the hard disk. That way, if someone can get to the disk, it still doesn't do you any good.

Re:Encryption...

[Mtgman]

Ah yes, and what happens when they open the briefcase and see the post-it note with the encryption key is stuck on top of the laptop? What they're looking for is a foolproof way of protecting their information. Encryption is only as secure as the protection provided to(not by) the key.

Steven

Re:Encryption...

[peter]

The people with this classified information are trained in keeping things secret. They know about things like passwords. (or they'd better!) Anyone too dumb to learn about not putting post-it notes on your screen probably doesn't have secret clearance.

Other than that, you've got a point. For ordinary corporate types, encrypting the HD is not as strong as one might thing.
#define X(x,y) x##y

hey stupid

[deran9ed]

uhm you must be a dumb ass... That program is written to remove data according to Department of Defense standards. The script I made just uses it to wipe what I specified.

What part of SECURELY WIPING did you miss out on dumb ass

Re:hey stupid

[ArchieBunker]

Your script must be run by some OS, correct? What if they use a boot disk? Or hook the drive up to another box for examination?

The mechanism must be done in hardware.

British Intelligence

[tealover]

http://www.dictionary.com/cgi-bin/dict.pl?term=oxy moron

Can I vote this (Troll, +1)?

[Ted V]

It seems slightly inflamatory, but he's got a real point. Or maybe I've just been suckered in. :)

Use on-the fly encryption, fercrissakes!

[HEbGb]

There are (at least) three extremely good packages available for performing seamless, convenient, on-the-fly encryption of your hard drives. I can't believe they are stupid enough to not only neglect to use one, but also to propose an unreliable physical 'bomb' to destroy the drive! C'mon!

Scramdisk, E4M, and PGPDisk all create 'virtual' mounted disks on your system, which act just as any normal disk. When you boot up, you run the software, 'mount' the virtual disk (it's a large file on your hard drive), and voila. You have a fully high-strength encrypted volume to use just like you would any other disk. Very, very easy. You can even install your apps there if you want.

The data itself is encrypted on the fly, and stored on fully encrypted form on the disk. Therefore, if the volume was unmounted (say, by rebooting), the data is totally unaccessible. If you just rely on your computer to kick into password-protected 'sleep' mode, or use a password-protected screen saver, you're pretty well covered - the only way you can really get by these things is by rebooting - which unmounts the encrypted disk. Abracadabra.

Everyone in business who travels with a laptop should be using software like this. Scramdisk is, in fact, free (Win98/ME, $20 for NT/2k), and open source! I believe E4M is free, as well (not sure about the source).

Take a look:

Scramdisk
E4M
PGP

Why this stuff isn't more universally used by laptop-travelers, especially government-secret or business-secret toters, is absolutely baffling. Hell, it's even easier to use than public-key encryption.

HebGb

Re:Use on-the fly encryption, fercrissakes!

[Ateran]

It won't work unless you also require agents to keep a disk with the decryption key seperate from the computer at all times except when mounting and unmounting the drive (and then the key is even more likely to get lost than the computer, leaving the data totally inaccessible). Otherwise, you have to store the key unencrypted on the computer, and it's a simple matter of cracking the password to the key, which will be extremely easy given unlimited time to do so.

Re:Use on-the fly encryption, fercrissakes!

[Regolith]

Well, as long as they are all using new OSs, that'd work. I remember back in Win95/98 you could CTRL+ALT+DEL and forcequit the screensaver. Didn't matter if it were password protected or not, didn't make any difference. Spit you right back into the desktop. It was great for actually being able to check out the new machines at BestBuy/Circuit City/etc., since they always left them running a passworded screensaver.

-----

Motion sensors & drive encryption

[Fencepost]

Take a look at this article from Computerworld a couple weeks ago.

Basically what the manufacturer is working on (it's not available yet) is a motion sensor and alarm, tied in with some form of drive encryption. Move it far enough that it thinks it's being stolen (user-configurable parameters) and it bluescreens the system and won't restart without a 16-digit code; the drive contents are protected because they're encrypted using keys built into the motion sensor system.

This is far from optimal:

• it presumably requires some significant driver support and will probably be limited to Win2k initially;
• anyone serious enough about it may be able to extract encryption keys from the device itself;
• hm, 16-digit number.... Guess I'll have to go through the guy's garbage for his credit card numbers;
• it's not available (though apparently betas exist).

Still, at the moment there aren't a lot of other options out there either. I'd expect to see quite a few more products along similar lines cropping up in the next few years.

There are certainly more effective possibilities out there....

One possibility would be a combination of hardware-level drive encryption keys and this sort of motion-sensor setup to keep the system from being stolen while active. Keys would be read from a removable device (iButton- or USBKey-like) as part of the power-up process and would be kept in RAM. Removing the key device would trigger a hardware-level system lock (many notebooks have these already, completely independent of the OS) but the system could keep running. Because the system stays on, it remains easy to step away from it while leaving it well protected - requiring the key to be present for drive access would be much more troublesome, because it would mean either shutting down or hibernating the system or having the OS aware of the protection so disk activity could be prevented without the key. This could be done almost entirely independent of the OS, with a fairly simple interface to make configuration changes.

-- fencepost

Re:Motion sensors & drive encryption

[Greyfox]

Hell fingerprint scanners are getting small enough now that you could stick one in a laptop. Have it require a scan to unlock the hard drive after coming out of sleep mode or being powered on. If the scan fails... well... boom... Of course, you'd want to have a few retries in there since it's kinda hard to get it exact on the first try. That presupposes you didn't steal the guy's thumb too. Normally they're pretty attached to them but a little persuasion with a hacksaw goes a long way...

Re:Motion sensors & drive encryption

[Jaysyn]

IBM already has one...sorry I don't have a link, maybe someone else knows what I'm talking about...

Jaysyn

You forgot...

[ClubPetey]

B*M
B*TTY
KN*CKERS
KN*CKERS
and...
SEMPRINI

This post brought to you by Tony M. Nyphots Flying Riscue
--
He had come like a thief in the night,

dis-info

[mediaeater]

This is a clever way of getting out information - Top Secret and all that - very neat dis-info plan - well done heh

ho-ly shit

[sllort]

Someone quick call britain and tell them the price of pgpdisk is down to 12 bucks a copy.

sheesh. all our notebook employees run this, and we're not even... setting anyone up the bomb.

Old News

[sharkey]

Simon did this in 1995 Search the page for the phrase "The Bastard wreaks his terrible revenge" and you'll have your reference.

--

I Know Where the Laptops Are!

[Cheshire Cat]

More than likely all these laptops wound up on eBay from broke intelligence agents. I know thats what happens to all the missing laptops from my company.

A simpler solution

[Tungz10]

Just build a handle into the stupid thing AND HANDCUFF IT TO YOURSELF!

There is no proof there was classifed data

[Darren.Moffat]

The only proof that there was classified data on the laptop is the media reports. Don't trust everything you read in the media.

The other thing to note is the classification scheme has a class called "unclassfied" which means that the data doesn't contain anything sensitive but it is still classified in the scheme

That's kind of heavy

[Tungz10]

They may want to consider attaching 15,000 handcuffs at 2 pounds apiece.

I'm sure handcuffs don't weigh that much. 900 grams, tops.

Re:That's kind of heavy

[ncc74656]

They may want to consider attaching 15,000 handcuffs at 2 pounds apiece.

I'm sure handcuffs don't weigh that much. 900 grams, tops.

£2, not 2 lbs. (I suspect that handcuffs would cost more than a couple quid, though.)

Distributed.net's RC5 client = Laptop Lojack!!!

[Sonicboom]

There's been a few cases where computers that were running the Distributed.net RC5-64 keycracking client were stolen and recoverd.

The client uploads and downloads blocks of possible keys to and from a central keyserver - and the "reported" blocks have your email address attached to them. So when the PC's/Laptops were stolen, they contacted Distributed.net, who went through the keyserver logs and found the IP address of the stolen computer. This information was turned over to authorities and the stolen computers were traced to the thieves and returned to their rightful owner(s). I am unaware of whether the distributed.net client(s) were CLI or GUI, or if they were running in "hidden mode". If in hidden mode they'd be invisible to the thief.

It's an interesting (and free) solution to finding stolen laptops... well... as long as the thief goes out onto the internet before wiping the hard drive.. but how many thieves are that saavy?

Re:Distributed.net's RC5 client = Laptop Lojack!!!

[The Critisizer]

There have also been cases where people have done something stupid like:

$ dd if=/dev/zero of=/dev/ad0s1

os/2

[Anonymous Coward]

rules
bmelloyello@aol.com

One big problem

[KurdtX]

Uh, this might be just a little difficult to get through airport security. I dunno, but I don't think the airlines will particuarly like the idea of someone carrying a bomb on board, no matter how small.

Kurdt

Re:One big problem

[Vuarnet]

Uh, this might be just a little difficult to get through airport security.
Dude, they're secret agents! They probably have flying motorcycles and stuff like that.

Planes? They dont need no stinkin' planes.


Tongue-tied and twisted, just an earth-bound misfit, I

Nope

[HEbGb]

The key is hashed right directly from the passphrase. With the passphrase, you can mount the drive. Without it, you can't. No need for keydisks and whatnot. Scramdisk even has provisions for hiding its own existance.

For any decent passphrase, breaking it will be impossibly difficult. Sure, with an 'unlimited' amount of time, but no one has 10^20 years to do it.

This method is totally viable, and successful. Read up at alt.security.scramdisk .

Re:Nope

[Ateran]

Sorry, I didn't realize that these implementations don't require a decryption key (I was thinking that it was pretty much the same as PGP). You're right.

Encrypted drives

[Squeamish Ossifrage]

There's been a lot of discussion of various ways to encrypt drives for protection, and also of ways to cause drives to self-destruct. The problem with the encryption systems is maintaining the secrecy of the key, when the attacker has access to all the hardware and software. The problem with the self-destruct systems is keeping things sufficiently controlled to destroy the data but not hurt anyone.

The following synthesis makes sense to me: Have the drive encrypted with a symetric-key cipher. Have the key stored in NVRAM or some equivalent. In normal operation, the encryption and decryption is handled transparently. either by software drivers, or (better yet) by the drive controller itself. Because no person needs to know the key, it can be truly random and long enough. To activate the self-destruct, simply erase the key. I don't know much about NVRAM, but I imagine that it is possible to "wipe" it sufficiently that the data can't be recovered. If not, this idea would have to be modified.

In the best-case scenario, all of this functionality is integrated into the drive controller, so that data is encrypted before it's sent to the disk, and decrypted before it's returned to the system bus. This makes life easier for everyone since the encrypted drive system looks just like a normal IDE (or SCSI) system from the outside. More importantly, it means that the key can be stored inside the controller card, and never needs to be made available to any other hardware or software. This minimizes the risk of key compromize, even by a malicious user.

The card would have to support an instruction (or physical connection) whereby it could be signalled to self-destruct. This could be activated by LoJack-style equipment, or what have you.

Once the key's truly erased, the contents of the drive become totally unusable.

Old Hat

[SailorBob]

Israel's been using similar kind of stuff to kill Arab terrorists for years. The most famous instance was back in 95 I believe. A terrorist nicknamed "The Engineer," took his cell phone in for repairs. The Israelis booby-trapped it with plastic explosives and after he got it back from repairs they called him to make sure he had the phone and detonated it remotely. The Arabs have been using simmilar techniques. They plant bombs in a public place like a restaraunt which have a cell phone as the detonating mechanism. After they're out of the area they call the cell phone and boom.

Destroying data is harder than you think...

[ouroboros]

When I read the bit about rigging the laptop case so that it would destroy the data on the hard drive if opened I thought, "short of physically destroying the disk, it won't work."

Unfortunately, erasing data is harder than you think. There was an article on rootprompt sometime back (sadly, I only saved a text copy of the article, not the URL; the author is Dr. Peter Gutmann of the CS Department at the University of Auckland) which went into some detail on what you would have to do. It was a long article and had many technical details, but the one sentence summary is this: "you have to overwrite the entire drive at least 35 times with a special set of bit patterns". Think how long that would take on a 20G drive (what my own laptop has)! I doubt the battery would be up to it, even if they didn't detach it.

Store the primary key on an iButton

[Paul Crowley]

Store the primary encryption key on tamper-resistant hardware like an iButton. That's designed to destroy the data onboard if anyone tries to open the case, without the need for messy explosives, and the steel case means the tamper resistance is pretty good.

Then use the passphrase to negotiate with the iButton for the key onboard. Unless you can defeat the tamper-resistance, bang goes any hope of dictionary attacks on supercomputers; you have to try each passphrase against the iButton, and it will impose longer and longer delays between tries. A strong password protocol like SRP will prevent some attacks based on this system.

Now the security from your passphrase is vastly greater. The iButton is pretty dinky and can be kept on your keyring (the thing that has your house keys on it, not a PGP keyring); it's unlikely you'll leave it in the back of a taxi alongside the laptop.

Of course the primary key is a proper high-entropy key (100 bits or more) so there's no hope of a brute force attack.

Does that sound secure enough?
--

IBM

[alexburke]

As usual, Big Blue has an answer.

Their TravelStar (and DeskStar, too) hard drives support the use of a password. The system's BIOS has to support it, but if it does (like the Dell Latitude's, I think), the hard drive will not permit any read or write commands to data areas. There's a master password which can be set to override the user password, but if you control both, and forget both, the only way to get the hard drive back is to send it a special command which will cause it to erase the entire user-accessible data area, then unlock itself.

Don't bother trying to change the logic board, either -- the passwords and settings are stored on a non-externally-addressable area on the platter.

--

Re:IBM

[Ektanoor]

According to underground whispers and urban legends that's already broken on DeskStar... Simple logical engineering game with some commands. Demanding knowledge - an average technician having some knowledge on HD architecture and the listing of commands on DeskStar controller.

I don't know about TravelStar.

US inteligence could use this

[Apps]

US inteligence could use this - on planes - in case a spy plane of theirs happened to be damaged and end up in foriegn hands! - but that would never happen!

If it was the US...

[cybergeek]

Come on, at least we're not leaving spy-planes around! That really would be careless.

Daniel

Wrong way around the problem

[kuzinov]

That's nice they are going to spend that much money on the special briefcases. I have a slightly better plan. How about NOT PUTTING NATIONAL SECRETS ON A GODDAMN LAPTOP. And on the occasion you do really need to, do the cliche and handcuff it to the couriers freaking arm. Let's see them leave it in a taxi then. Both the British and U.S. have had appalling breaches of security with portable computers and devices. What I think really needs to happen is for the system and or security admins to get more authority to tell some of these people how to operate. Give the admins enough authority to tell the little scientists and agents that "hey, I'm sorry you find this inconvenient, but, you're working with whatever national secrets. Too freaking bad, deal with it". Then maybe you won't have missing laptops and harddrives(Los Alamos) as often.

I can just hear it...

[tb3]

"Now pay attention, 007, here is your new laptop."
"All the usual refinements, laser cutter here, rocket launcher here, life-raft here,self-destruct mechanism here."
"Unfortunately, we've had to install Windows XP as an operating system, so you won't be able to use it as a computer."
-----------------

The idea has been around but....

[linuxrunner]

Who ever comes up with the totally secure computer will probably make more than a ripple in the computing world.

We all know that any computer can be cracked... It's just a question of time.
I like the idea of having a program that you must go through first. A password that only allows three incorrect entries. There's no way around this password mind you...
After three entries the computer starts to erase itself (format if you would..). The program will shove a file in the registry at the same time. This will ensure that even if the computer is shut off the HD will resume erasing when turned back on..

Or take it a step further, have all of that plus a secret battery in the computer / laptop that is constantly being recharged by the bigger battery. This secondary battery has just enough charge to allow the computer to format itself. That way in the event of a force opening and format if the culprit tries to turn off the computer to prevent the formatting, he/she/they can't.

Ba da bing ba da boom bye bye box.

Linuxrunner

Not a good idea

[Ventilator]

Self destruction, well okay if it just renders the laptop out of use but implementing semtex or anything like these is a bit exagerated. Just think, some evil coder builds a virus with a payload to trigger self destruction if available. As Melissa, Iloveyou and other viruses have shown, within some days most governments and secret services will have to buy new laptops for their employees and have new employees as well.

The blue screen of death will have to be renamed to "blow screen of death".

NIST's FIPS standard

[mtnbkr]

check this out: http://csrc.nist.gov/publications/fips/fips140-1/f ips1401.htm

That's Right

[Greyfox]

It was a Tivo-like device the brand name to which I will not name. Management explicitly stated they didn't want people to be able to upgrade the hard drive. They also had requirements from the MPAA to incorporate copyright contros so that people wouldn't rip the hard drive out and post episodes of Dharma and Greg on the Internet. Hack or crack, they didn't want it happening. A tiny little speck of thermite to fry the circuitry on the motherboard and hard drive would have done the trick quite nicely. They didn't go for the suggestion, though. I'm rather surprised really. They had the right mindset.

No, that's not as secure.

[Paul Crowley]

Passphrases are typically low entropy beasts; a brute force attack tends to be effective against them if you can gather a decent wodge of computing power. You can use key stretching to make things harder, but that only gets you so far.

So the point of the primary key and tamper-resistant hardware approach is that the attacker no longer has the option of trying passphrases on their supercomputer. With what I'm suggesting, the only way to try a passphrase is to try and use it to log into the iButton. The iButton gets to decide how often you can try in a given time period, and for how long it'll lock you out if those attempts fail. That's vastly more secure.

Also, you now need two things to break in: the passphrase and the bit of hardware. Even if they've used "password" as their password, stealing the laptop still isn't enough; and you're much less likely to leave the iButton lying around anywhere.

Obviously the passphrase will be hashed as part of the key stretching protocol, and obviously you design things so that even if you can break the tamper-resistance you still have to brute-force the passphrase, but the iButton adds a very significant extra hurdle that could really make the difference for security.
--

It's much simpler than that.

[billstewart]

You don't store the key in the machine, where you have to trust your system to erase it. You have the key entered by the user when they boot. No key, no valid blocks decrypted from the disk. There are plenty of encrypting file systems that do this correctly, though probably others that botch the job (:-) If you want better randomness than that, yes, store additional bits somewhere like NVRAM or on the unencrypted parts of the disk, and hash them together with the user's passphrase to get the drive key.

In practice, it's tough to put the drive encryption on the disk controller, especially for laptops where the controller's integrated into the motherboard. (Most desktops also integrate it, but you can still run a separate controller board.) Either put it in the disk drivers (so you're writing encrypted blocks to the disk, but not changing the file system code), or else put it in the file system code (which has different limitations, but is much more friendly about keeping encrypted and unencrypted partitions, e.g. /usr can be unencrypted read-only while /home and /swap are encrypted.)

Keys way too short

[billstewart]

16 digits? That's only ~48 bits, which is way lame, and doing decent encryption doesn't take any more work. And yes, that does invite use of a credit card number as the key, which maybe safer than some kinds of numbers because you won't leave it on a yellow sticky note next to the computer but is otherwise wildly insecure. (Especially to anybody who wants to spend a few bucks on a credit report :-)

Encryption drives uncommon because of export laws.

[billstewart]

Definitely, encrypting the drive is cheaper, much more effective, and also doesn't require carrying your 2-kg laptop in a 10-kg armor-plated bullet-proof phone-home-capable handcuff-equipped trenchcoat-color-coordinate briefcase (although that can be 31337 k00l if you're into that sort of thing :-)

Fundamentally, this is a case of governments shooting themselves in the foot with anti-encryption policies.* While there are encrypting file systems available, including commercial and freeware, they're not universal, hardware support for encryption and encrypted disk drives aren't universal, and lots of products are dumbed down to 40-bit or 56-bit crypto because of US export laws and those of other countries which the US talked into adopting. Many of the policies had the pretense, or sometimes the serious motivation, of keeping Commies from getting crypto, because we all know that Commies can't read math books and write software using them, but in large part they were supported and promoted by civilian wiretapping enthusiasts like the US FBI and the UK Home Secretary, who want to be able to keep track of everything their subjects** do, say, write, read, or look at. Instead, they're endangering the security of their military secrets, making it more likely that Commies and Terrorists can get them from stolen laptops and other unencrypted and underencrypted sources like GSM cell phones.

* OK, it's partly the US government helping the UK government get shot in the foot, but Louie The Freeh and Mr Jack Straw really deserve each other...

* Yes, US Citizens aren't technically subjects, and UK people are subjects of the Queen, not the Home Office, but that's not how the internal police forces *feel* about them....

Re:Encryption drives uncommon because of export la

[peter]

That's got to be crap. You can't be serious that the cops/government can't use strong encryption. They made the rules; they can bend them to their advantage.
#define X(x,y) x##y

Tool for self-destructing laptops

[cryptophile]

The concept you're talking about already exists. Lucira Technologies (http://www.lucira.com) has a tool for recovering stolen laptops. The product is based on using IP addresses and telephony to pin point the location of a stolen laptop. A mechanism for doing data destruction on the laptop is nearly ready for release.

Memories of "Starship Troopers"

[alexburke]

Would you like to know more?

Yes, please!

(Translation: It seems as though you know more about this than you're letting on. Can you email me with the juicy bits if you have a moment?)

Thanks!

--